{"uid":"cap_GiGwKpQtYyUbiDRuxfTUT","slug":"annalist-package-supply-chain-check-33242695","name":"Annalist Package Supply-Chain Check","description":"Supply-chain check of a popular package (the 8,000 most used on each of npm, PyPI, crates.io and Go): latest version and release activity, maintainers or owners, install scripts, provenance, deprecation, retractions, and what changed since we began tracking it daily: releases by a new publisher account, owner changes, install scripts added, provenance dropped, source repository moved, yanks. Account names are never published. Signed.","url":"https://api.annalist.dev/v1/packages/check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"package name, for example lodash, requests, serde or golang.org/x/crypto"},"ecosystem":{"enum":["npm","pypi","crates","go"],"type":"string","description":"npm (default), pypi, crates or go"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_6849udF1vaeCgJUrd1J4N","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a supply-chain security profile for a single npm, PyPI, crates.io, or Go package: version, maintainers, install scripts, provenance, deprecation, and recent anomalous changes.","exampleAgentPrompt":"Can you do a supply-chain check on the lodash npm package — I want to know if there have been any owner changes, new publisher accounts, install script additions, or provenance issues since you started tracking it?","exampleUseCases":[{"title":"Audit dependency before shipping","prompt":"Before I cut this release, can you check the requests PyPI package for any recent red flags — new maintainers, install scripts added, provenance dropped, or yanked versions?"},{"title":"Monitor critical package for takeover signs","prompt":"Has the serde crate on crates.io had any owner changes, new publisher accounts, or source repo moves lately? I want to make sure it hasn't been taken over."},{"title":"Validate Go module integrity","prompt":"Check golang.org/x/crypto on the Go ecosystem for me — is the latest version still properly signed, and has anything suspicious changed like a new publisher or added install scripts?"}],"resultDescription":"A signed JSON response containing: latest version and release activity, current maintainers/owners, presence of install scripts, provenance status, deprecation and retraction flags, and a changelog of anomalous events detected since daily tracking began — including releases by new publisher accounts, owner changes, install scripts added, provenance dropped, source repository moves, and yanks. Account names are omitted from the response.","failureModes":["Package not found in the specified ecosystem — returns error if the package name is not in the tracked top-8,000 list","Missing required 'name' query parameter — returns validation error","Invalid ecosystem value — only npm, pypi, crates, go are accepted","Payment failure — x402 payment of 0.01 USDC required per call; unpaid requests are rejected","Network or upstream data unavailability — may return stale or partial data"],"whenToPreferThis":"Use this endpoint when you need a fast, structured, signed supply-chain audit of a single popular package before installing or shipping it, especially when you care about owner changes, new publisher accounts, install scripts, or provenance integrity. Prefer this over general package registry APIs when you want anomaly detection and historical change tracking rather than just package metadata. Best for automated CI/CD security gates or agent-driven dependency review flows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T18:30:40.341Z","isFirstParty":false,"canonicalSlug":"annalist-package-supply-chain-check-33242695"}