{"uid":"cap_3ZR3dg4XAkGG4z3DNqWuB","slug":"stack-facts-preflight-package-security-check-de41f82b","name":"Stack Facts Preflight Package Security Check","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/preflight/%7Becosystem%7D/%7Bname%7D?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","properties":{"properties":{"type":"string"}}},"responseSchema":{"type":"json","example":{"data":{"vulns":{"count":0,"max_cvss":null,"malicious":false,"max_severity":null,"versions_unknown":0},"notice":"request has been deprecated, se…","yanked":false,"licence":{"use":"distribute","spdx":"Apache-2.0","class":"permissive","verdict":"compatible","declared":"Apache-2.0","project_license":"proprietary"},"package":{"name":"request","purl":"pkg:npm/request@2.88.2","ecosystem":"npm","registry_url":"https://www.npmjs.com/package/r…"},"reasons":[{"code":"deprecated","notice":"request has been deprecated, se…","verdict":"caution"}],"verdict":"caution","kev_cves":[],"deprecated":true,"published_at":"2020-02-11T16:35:36.122Z","latest_version":"2.88.2","kev_catalog_version":"2026.10.10"},"meta":{"stale":false,"notice":"Normalised (modified) from the …","dataset":"preflight","datasets":{"kev":{},"osv":{},"license":{},"package":{}},"licences":"/licences"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_BugQCJyT0-ppHHIRGnN6-","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns security, vulnerability, malware, end-of-life, and license data for a named package in a given ecosystem before installation","exampleAgentPrompt":"Before I install the npm package 'request', can you run a preflight security check on it — I want to know if it has any known vulnerabilities, exploited CVEs, malware flags, or license issues?","exampleUseCases":[{"title":"Pre-install dependency security check","prompt":"I'm about to add 'axios' from npm to my project — can you check if it has any known vulnerabilities, CISA KEV CVEs, or malware issues before I install it?"},{"title":"License compatibility review for commercial app","prompt":"I need to use the PyPI package 'requests' in a commercial product — can you check what license it uses and whether it's compatible with closed-source distribution?"},{"title":"Audit deprecated package in legacy codebase","prompt":"Our codebase still uses the npm package 'request' — can you check if it's deprecated, end-of-life, or has any unpatched vulnerabilities I should know about?"}],"resultDescription":"A JSON object containing: overall safety verdict (safe/caution/unsafe), vulnerability count and max CVSS score, malware boolean, list of CISA KEV CVEs, deprecation and yanked status, license SPDX identifier and compatibility verdict, latest published version, and dataset freshness metadata. Answers are cryptographically signed.","failureModes":["Unknown ecosystem or package name returns a 404 or empty result","Payment failure (insufficient USDC) results in 402 response before data is returned","Stale dataset flag in meta indicates data may not reflect the very latest registry state","Package with no version history may return versions_unknown count > 0","Malformed ecosystem/name path parameters may cause request errors"],"whenToPreferThis":"Choose this endpoint when an AI agent or automated pipeline needs to vet a third-party package before installation in a software project, especially when no API key or account setup is desired and pay-per-call USDC micropayment via x402 is acceptable. It is uniquely suited for supply-chain security checks combining OSV vulnerability data, CISA KEV exploited CVE cross-referencing, malware detection, and license compatibility in a single signed response — covering npm, PyPI, and other major ecosystems.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-19T06:42:04.421Z","isFirstParty":false,"canonicalSlug":"stack-facts-preflight-package-security-check-3d435aa9"}