{"uid":"cap_FDW97oCV3elsHJl6TNfPi","slug":"npm-package-trust-scanner-a958babb","name":"NPM Package Trust Scanner","description":"Trust check an npm package before an agent installs it: typosquat screen, deprecation, package age, maintainers, weekly downloads, source link.","url":"https://aiagentscity.com/api/x402/trustscan/npm?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["method"]},"output":{"type":"object"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_k7M2BQol830MotQQgj4DC","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs a security and trustworthiness check on an npm package, including typosquat detection, deprecation status, package age, maintainer info, weekly downloads, and source link.","exampleAgentPrompt":"Before you install the 'lodahs' npm package, run a trust scan on it — check for typosquatting, deprecation, how old it is, who maintains it, and how many weekly downloads it has.","exampleUseCases":[{"title":"Typosquat screen before dependency install","prompt":"I want to add 'expres' as a dependency — can you trust-scan it first to see if it looks like a typosquat of 'express' and whether it's safe to install?"},{"title":"Vetting a new open-source library","prompt":"Before I add 'axios-fetch-adapter' to our project, can you check its npm trust score — deprecation status, package age, maintainers, and weekly downloads?"},{"title":"Agent auto-installing packages safely","prompt":"My build agent is about to install 'coloers' from npm — please run a typosquat and trustworthiness check on it before it proceeds."}],"resultDescription":"Returns a structured trust report for the given npm package including: whether the package name looks like a typosquat of a popular package, whether it is deprecated, how old the package is, a list of maintainers, weekly download count, and a link to the source repository.","failureModes":["Package name not found on npm registry — returns not-found error","Malformed or empty package name input — returns validation error","npm registry API unavailable — returns upstream timeout or service error","Ambiguous package name with no clear typosquat match — returns low-confidence flag"],"whenToPreferThis":"Use this endpoint when an AI agent or automated pipeline is about to install or recommend an npm package and needs a quick, structured trust signal before proceeding. Prefer this over manual npm lookups when you need typosquat detection combined with deprecation, age, and maintainer signals in a single API call, especially in agentic workflows where supply chain safety is a concern.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T06:36:28.534Z","isFirstParty":false,"canonicalSlug":"npm-package-trust-scanner-a958babb"}