{"uid":"cap_3QyO-GkWqTAuCpdRAKHDE","slug":"stack-facts-package-security-vulnerability-check-7140b31b","name":"Stack Facts: Package Security & Vulnerability Check","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/stack/check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"cves":{"type":"array","items":{"type":"string","pattern":"^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$","maxLength":32},"maxItems":100,"minItems":0},"items":{"type":"array","items":{"anyOf":[{"type":"string","pattern":"^[^@]+@.+$","maxLength":401,"minLength":3},{"type":"object","required":["product","version"],"properties":{"product":{"type":"string","maxLength":200,"minLength":1},"version":{"type":"string","maxLength":200,"minLength":1}},"additionalProperties":false}]},"maxItems":50,"minItems":0},"packages":{"type":"array","items":{"type":"string","pattern":"^pkg:","maxLength":512,"minLength":7},"maxItems":50,"minItems":0}}},"responseSchema":{"type":"json","example":{"data":{"eol":{"count":2,"matched":2,"results":[{}],"unknown":[],"unknown_count":0},"kev":{"count":2,"in_kev":1,"results":[{}],"catalog_version":"2026.10.10"},"osv":{"count":1,"results":[{}],"summary":{},"kev_catalog_version":"2026.10.10"},"summary":{"cves":2,"items":2,"in_kev":1,"matched":2,"unknown":0,"packages":1,"by_status":{},"packages_in_kev":0,"packages_affected":1}},"meta":{"stale":false,"notice":"Normalised (modified) from the …","dataset":"stack","datasets":{"eol":{},"kev":{},"osv":{}}}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.012","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.012/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.012","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.012","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_8606vU2QPnkf-0E_DC215","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.012","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks packages, purls, or CVEs for malware, OSV vulnerabilities, CISA KEV exploited CVEs, and end-of-life status, returning signed results payable per-call in USDC","exampleAgentPrompt":"Before I install lodash@4.17.20 and express@4.18.2, can you check both packages for malware, known vulnerabilities, exploited CVEs from the CISA list, and whether either is end-of-life?","exampleUseCases":[{"title":"Pre-install dependency audit","prompt":"I'm about to install pkg:npm/lodash@4.17.20 and pkg:npm/axios@0.21.1 — can you check both for malware, OSV vulnerabilities, and whether they appear in the CISA Known Exploited Vulnerabilities list before I add them to the project?"},{"title":"CVE exploitability triage","prompt":"We got flagged for CVE-2021-44228 and CVE-2022-22965 in our security scan — can you check if either of those CVEs is actively exploited and listed in the CISA KEV catalog?"},{"title":"Node.js end-of-life check","prompt":"Our server is running nodejs@18.19.0 and python@3.8.0 — are these versions still supported or are they end-of-life? Also flag any known security advisories for them."}],"resultDescription":"A structured JSON object containing: per-package OSV vulnerability advisories (with affected/malicious status), CISA KEV membership per CVE, end-of-life status per product/version, a summary counts object, and dataset metadata including signatures, source attribution, and freshness timestamps for each data source (OSV, KEV, EOL).","failureModes":["Payment not provided or insufficient USDC — 402 Payment Required","Invalid purl format (must start with 'pkg:') — schema validation error","CVE format mismatch (must match CVE-YYYY-NNNNN pattern) — validation rejection","Too many items submitted (>50 packages or >100 CVEs) — request rejected","Unknown package or version not found in OSV — returned as unanswered/unknown in results","Stale dataset flag set to true if upstream data sources haven't refreshed recently"],"whenToPreferThis":"Choose this endpoint when you need a single call to cross-reference a package or CVE across multiple authoritative security data sources (OSV, CISA KEV, endoflife.date) simultaneously, with cryptographically signed responses and no account setup. Prefer this over raw OSV or CISA APIs when you want normalized, aggregated results with malware detection and EOL status in one payload, and when pay-per-use USDC micropayment model fits better than subscription API keys.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:37:06.528Z","isFirstParty":false,"canonicalSlug":"stack-facts-package-security-vulnerability-check-7140b31b"}