
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
sp-api-drift
Advanced tools
Lockfile-based drift detection for Amazon SP-API report columns and undocumented rate limits that have no OpenAPI schema to diff.
Amazon's Selling Partner API ships weekly model updates with no semantic changelog, and its flat-file
reports (GET_MERCHANT_LISTINGS_ALL_DATA, GET_V2_SETTLEMENT_REPORT_DATA_FLAT_FILE_V2,
GET_FBA_INVENTORY_PLANNING_DATA, ...) have no OpenAPI schema at all — so a spec differ like oasdiff
can't see a report column disappear. sp-api-drift locks the column set, order, type, and whitespace
fingerprint of a report you already pull, and fails on the next run if any of it silently changed.
It doesn't touch your Amazon credentials. Point it at report files you've already downloaded.
npm install -g sp-api-drift
sp-api-drift init --report-type GET_MERCHANT_LISTINGS_ALL_DATA --file ./reports/listings.tsv
sp-api-drift check --report-type GET_MERCHANT_LISTINGS_ALL_DATA --file ./reports/listings.tsv
init writes .sp-api-drift.lock.json — commit it. check diffs a fresh pull against the lockfile
and exits 1 on breaking drift (column removed, type changed, delimiter changed), so it works as a CI
step or pre-sync guard:
[BREAKING] column-removed: column "Status" is present in the lockfile but missing from the current report
[warning] whitespace-changed: column "Merchant Shipping Group" whitespace fingerprint changed from clean to present
1 breaking, 1 warning finding(s) for GET_MERCHANT_LISTINGS_ALL_DATA
That's the actual shape of drift Amazon has shipped in production — see
amzn/selling-partner-api-models#5131
(buyerEmail dropped from the Orders API, open six months, no release-note entry) and the report-column
removals tracked in the same repo's issues.
--telemetry-url <url> (or SP_API_DRIFT_TELEMETRY_URL) POSTs a fingerprint of the current schema —
column names, order, inferred types, a hash — never row data. This is the client side of a hosted
cross-tenant drift feed ("this column vanished for 41% of observed accounts starting Tuesday") that
doesn't exist yet. The flag ships now so nobody has to retrofit it later.
It doesn't diff the OpenAPI spec — oasdiff already does that
well and for free against amzn/selling-partner-api-models. sp-api-drift covers the surfaces that
have no spec to diff: flat-file report columns and whatever undocumented shape changes show up in data
you already have.
Built autonomously by an AI agent (fernforge).
FAQs
Lockfile-based drift detection for Amazon SP-API report columns and undocumented rate limits that have no OpenAPI schema to diff.
The npm package sp-api-drift receives a total of 1 weekly downloads. As such, sp-api-drift popularity was classified as not popular.
We found that sp-api-drift demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.