{"uid":"cap_BgOwjlfpm-KjXpvLGACgL","slug":"package-risk-check-npm-pypi-supply-chain-verdict-aa063582","name":"Package Risk Check – npm & PyPI Supply-Chain Verdict","description":"Package Risk Check ($0.01/call): One-call supply-chain verdict before installing a package: known vulnerabilities (OSV), package and version age, install-time script hooks, deprecation, weekly downloads, typosquat distance to popular names, and a transparent low/medium/high risk level with reasons. Covers npm and PyPI, keyless upstreams.","url":"https://x402.botsmith.dev/pkg-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["name","ecosystem"],"properties":{"name":{"type":"string","pattern":"^(@[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}\\/)?[a-zA-Z0-9][a-zA-Z0-9._-]{0,212}$","description":"Package name (npm supports @scope/name)"},"version":{"type":"string","pattern":"^[0-9A-Za-z.+-]{1,64}$","description":"Exact version to check; defaults to the latest release"},"ecosystem":{"enum":["npm","pypi"],"type":"string","default":"npm","description":"Package registry (default npm)"}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["ecosystem","name","version","latestVersion","vulnerabilities","package","installScripts","weeklyDownloads","typosquat","risk"],"properties":{"name":{"type":"string"},"risk":{"type":"object","required":["level","reasons"],"properties":{"level":{"enum":["low","medium","high"],"type":"string"},"reasons":{"type":"array","items":{"type":"string"},"description":"Human-readable evidence behind the level"}},"additionalProperties":false},"package":{"type":"object","required":["firstPublishedAt","versionPublishedAt","lastPublishedAt","versionCount","deprecated","maintainerCount"],"properties":{"deprecated":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Deprecation/yank message when flagged"},"versionCount":{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991},"lastPublishedAt":{"anyOf":[{"type":"string"},{"type":"null"}]},"maintainerCount":{"anyOf":[{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991},{"type":"null"}],"description":"npm only; null for pypi"},"firstPublishedAt":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"When the package first appeared in the registry"},"versionPublishedAt":{"anyOf":[{"type":"string"},{"type":"null"}]}},"additionalProperties":false},"version":{"type":"string","description":"The version this verdict applies to"},"ecosystem":{"enum":["npm","pypi"],"type":"string"},"typosquat":{"type":"object","required":["suspicious","similarTo"],"properties":{"similarTo":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Popular package this name imitates, when suspicious"},"suspicious":{"type":"boolean"}},"additionalProperties":false},"latestVersion":{"anyOf":[{"type":"string"},{"type":"null"}]},"installScripts":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"description":"npm install-time hooks (preinstall/install/postinstall/prepare); null for pypi"},"vulnerabilities":{"type":"array","items":{"type":"object","required":["id","aliases","summary","severity"],"properties":{"id":{"type":"string","description":"OSV advisory id"},"aliases":{"type":"array","items":{"type":"string"},"description":"CVE/GHSA aliases"},"summary":{"anyOf":[{"type":"string"},{"type":"null"}]},"severity":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Severity label or CVSS vector when known"}},"additionalProperties":false},"description":"Known vulnerabilities affecting this exact version"},"weeklyDownloads":{"anyOf":[{"type":"integer","maximum":9007199254740991,"minimum":-9007199254740991},{"type":"null"}]}},"additionalProperties":false}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_3_XJnhq8PRVmgL0_6GI52","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a transparent low/medium/high supply-chain risk verdict for an npm or PyPI package, covering known CVEs, age, install scripts, deprecation, download volume, and typosquatting distance.","exampleAgentPrompt":"Before I add it to the project, can you run a supply-chain risk check on the npm package 'lodash' version 4.17.21 and tell me the risk level with reasons?","exampleUseCases":null,"resultDescription":"A JSON object with ecosystem, package name, version checked, latest version, a structured risk object (level: low/medium/high, plus human-readable reasons), known vulnerabilities from OSV, package and version publish dates, deprecation status, install-time hook presence, weekly download count, typosquat distance to popular names, and maintainer count.","failureModes":["Package not found in the specified ecosystem — returns an error indicating unknown package","Invalid package name format — rejected by schema validation before the call is made","Invalid version string — schema pattern mismatch","Unsupported ecosystem value (anything other than npm or pypi) — enum validation failure","Upstream registry or OSV API temporarily unavailable — may return a 5xx or timeout","Payment not included or insufficient — x402 payment required response"],"whenToPreferThis":"Use this endpoint when you need a single-call, comprehensive supply-chain safety verdict on an npm or PyPI package before installing it — especially when you want CVE data, typosquat detection, install-script auditing, and age/popularity signals all bundled together rather than calling multiple separate APIs. Prefer it over generic vulnerability scanners when you need a transparent risk level with human-readable reasons and do not have your own OSV integration.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:34:51.286Z","isFirstParty":false}