{"uid":"cap_C1pT8IZBicwiBQnlIV-6Q","slug":"depvet-package-risk-check-087aca33","name":"DepVet Package Risk Check","description":"NPM supply chain attack and malicious package check for npm and PyPI: typosquat detection, dependency vulnerability scan (CVE/OSV), license check, OpenSSF Scorecard. OK/REVIEW/AVOID verdict before you install. No API key: pay USDC on Base per call via x402.","url":"https://depvet.imac2014ville.workers.dev/check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name, e.g. express, @types/node, requests"},"version":{"type":"string","description":"Exact version (default: latest)"},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"Package ecosystem"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ok":true,"name":"requests","license":"Apache-2.0","verdict":"OK","version":"2.32.3","ecosystem":"pypi","deprecated":false,"licenseRisk":"permissive","vulnerabilities":{"count":0,"malware":false,"maxSeverity":"NONE"},"typosquatSuspect":false}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_IjMzqgclJ-Ps2CtjAScRG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns an OK/REVIEW/AVOID verdict for an npm or PyPI package based on vulnerabilities, malware, license risk, deprecation, maintenance health, OpenSSF Scorecard, and typosquat detection","exampleAgentPrompt":"Before I add it to my project, check whether the npm package 'axios' is safe to use — I want to know about any vulnerabilities, malware flags, license issues, or signs it might be a typosquat.","exampleUseCases":[{"title":"Pre-install security gate for npm","prompt":"I'm about to install the npm package 'colors' version 1.4.0 — can you run a full risk check on it and tell me if it's safe, flagged for malware, or has any license problems?"},{"title":"Python dependency audit before deployment","prompt":"We're shipping to production tomorrow and I need to make sure the PyPI package 'requests' version 2.32.3 has no known vulnerabilities or deprecation issues — can you get the full verdict?"},{"title":"Typosquat detection for suspicious package","prompt":"Someone on my team wants to add an npm package called 'reaqct' — can you check if it looks like a typosquat or has any security red flags before we approve it?"}],"resultDescription":"A JSON object containing: overall verdict (OK, REVIEW, or AVOID), package name, version, ecosystem, license name and risk level (permissive/copyleft/unknown), deprecation flag, vulnerability summary (count, malware boolean, max severity), and a typosquat suspicion boolean. All signal sources include OSV vulnerability data, malware advisories, and OpenSSF Scorecard.","failureModes":["Package not found in the specified ecosystem — returns an error or non-OK status","Invalid ecosystem value (only 'npm' and 'pypi' are supported)","Payment failure via x402 — call is rejected before analysis runs","Version string does not exist for the given package — may fall back to latest or return error","Network timeout reaching upstream data sources (OSV, OpenSSF)","Rate limiting or temporary worker unavailability on the Cloudflare Workers backend"],"whenToPreferThis":"Use DepVet when an AI agent needs a fast, pre-install security verdict on a specific npm or PyPI package — especially in automated workflows, CI/CD pipelines, or agentic coding assistants where you want a single opinionated OK/REVIEW/AVOID signal rather than raw CVE data. It is ideal for agents that cannot afford to parse multiple upstream security feeds themselves. Prefer this over manual OSV queries when you also need license risk, typosquat hints, and maintenance health in one call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:31:23.344Z","isFirstParty":false,"canonicalSlug":"depvet-package-risk-check-087aca33"}