{"uid":"cap_7p8qkY1V2Wq6c5HeGV9-8","slug":"package-security-advisory-lookup-c77f8e58","name":"Package Security Advisory Lookup","description":"Pay-per-call utilities for AI agents over x402, USDC on Base.","url":"https://agents.crowdspark.me/v1/dev/package-advisories?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name, e.g. lodash or requests (maven: group:artifact)"},"version":{"type":"string","description":"Optional. Defaults to the latest version"},"ecosystem":{"enum":["npm","pypi","cargo","go","maven"],"type":"string","description":"Package ecosystem"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"name":"lodash","reasons":["5 known advisories affect this version (worst: high)","a newer version exists"],"verdict":"avoid","version":"4.17.20","licenses":["MIT"],"ecosystem":"npm","deprecated":false,"latest_version":"4.18.1","version_checked":"requested","vulnerabilities":{"count":5,"items":[{"id":"GHSA-29mw-wpgm-hmr9","cve":["CVE-2020-28500"],"fixed_in":["4.17.21"],"severity":"MODERATE"}],"by_severity":{"HIGH":2,"MODERATE":3}},"suggested_min_fixed_version":"4.18.0"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__vxCCP0D-m-7Aq9isnnAh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns known vulnerabilities, license, latest version, deprecation status, and a safe/caution/avoid verdict for a given npm, PyPI, cargo, Go, or Maven package version.","exampleAgentPrompt":"Before I add lodash version 4.17.20 to my project, can you check if it has any known vulnerabilities in npm and tell me if I should avoid it or if there's a safe version to use instead?","exampleUseCases":[{"title":"Pre-install vulnerability check for npm package","prompt":"I'm about to install lodash 4.17.20 in my Node.js project — can you check if that version has any known CVEs or advisories and tell me whether it's safe to use or if I should upgrade to a newer version?"},{"title":"Python dependency audit before release","prompt":"We're about to ship a release and I want to make sure the requests 2.27.1 PyPI package we're depending on doesn't have any known security issues — can you check its vulnerability status and tell me the latest safe version?"},{"title":"Check deprecated or risky Rust crate","prompt":"Can you look up the cargo package 'openssl' version 0.10.45 and tell me if it's deprecated, what vulnerabilities affect it, and what the minimum fixed version is?"}],"resultDescription":"A JSON object containing the package name, ecosystem, version checked, vulnerability count and items (with CVE IDs, severity, and fixed-in versions), severity breakdown (HIGH/MODERATE/LOW counts), latest version and whether it is newer, license(s), deprecated flag, a suggested minimum fixed version, and an overall verdict of 'safe', 'caution', or 'avoid' with human-readable reasons explaining the decision.","failureModes":["Unknown package name returns a 404 or empty result","Unsupported ecosystem returns a validation error","Specifying a version that does not exist may return no vulnerability data or an error","Rate limit exceeded on free tier (>25 calls/day per IP without payment header) returns 402 or 429","Network timeout if OSV.dev upstream is slow","Maven packages require group:artifact format; bare artifact name may fail"],"whenToPreferThis":"Use this endpoint when an AI agent or developer workflow needs to quickly audit a single package version for security issues before installation, dependency pinning, or CI/CD gating. It is ideal when you need a single-call verdict (safe/caution/avoid) with supporting CVE details and a suggested fix version, without needing to integrate directly with OSV.dev or multiple package registries. Prefer it over raw OSV.dev API calls when you also need license, deprecation status, and latest version in one response.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:45.365Z","isFirstParty":false,"canonicalSlug":"package-security-advisory-lookup-c77f8e58"}