{"uid":"cap_PXZNAmjVNh_Mmk4jFQWgT","slug":"vextorium-package-vulnerability-lookup-8df8737b","name":"Vextorium Package Vulnerability Lookup","description":"Known vulnerabilities of a software package (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist...) at a given version or overall: CVE/GHSA ids, summary, severity, publication date and fixed versions. Google's OSV.dev database.","url":"https://api.vextorium.com/vulnerabilidades-paquete-pago?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"required":["paquete","ecosistema"],"properties":{"paquete":{"type":"string"},"version":{"type":"string"},"ecosistema":{"type":"string","description":"npm, pypi, cargo, go, maven, nuget, rubygems, packagist, hex, pub"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":["object","null"],"properties":{"fuente":{"type":["string","null"]},"detalle":{"type":["array","null"],"items":{"type":["null","object"],"properties":{"id":{"type":["null","string"]},"alias":{"type":["array","null"],"items":{"type":["null","string"]}},"resumen":{"type":["null","string"]},"gravedad":{"type":["null","string"]},"publicada":{"type":["null","string"]},"corregida_en":{"type":["array","null"],"items":{"type":["null","string"]}}}}},"paquete":{"type":["string","null"]},"version":{"type":["string","null"]},"veredicto":{"type":["string","null"]},"ecosistema":{"type":["string","null"]},"vulnerabilidades":{"type":["number","null"]}}}}}}},"responseSchema":{"type":"json","example":{"fuente":"OSV.dev (CC BY 4.0)","detalle":[{"id":"GHSA-35jh-r3h4-6jhm","alias":["CVE-2021-23337","CVE-2026-4800"],"resumen":"Command Injection in lodash","gravedad":"HIGH","publicada":"2021-05-06","corregida_en":["4.17.21"]},{"id":"GHSA-p6mc-m468-83gw","alias":["CVE-2020-8203"],"resumen":"Prototype Pollution in lodash","gravedad":"HIGH","publicada":"2020-07-15","corregida_en":["4.17.19","4.17.20"]}],"paquete":"lodash","version":"4.17.15","veredicto":"6 vulnerabilidades conocidas: actualiza a una versión corregida","ecosistema":"npm","vulnerabilidades":6}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_0SUFcVtW0vyYEJBnmQA5I","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns known security vulnerabilities (CVE/GHSA) for a software package at a given version, sourced from Google's OSV.dev database, covering npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, and more.","exampleAgentPrompt":"Check if lodash version 4.17.15 on npm has any known security vulnerabilities — I need the CVE IDs, severity levels, and which versions fix them.","exampleUseCases":[{"title":"Auditing a Python dependency before release","prompt":"Before I ship my project, can you check if requests version 2.25.0 on PyPI has any known CVEs or GHSA advisories, and tell me what fixed versions are available?"},{"title":"Scanning a Rust crate for security issues","prompt":"Does the serde_json crate version 1.0.85 on cargo have any known vulnerabilities? I need the severity and fix versions if there are any."},{"title":"Verifying a Maven artifact for a security review","prompt":"I'm doing a security audit — can you look up any known vulnerabilities for the log4j Maven package version 2.14.1 and list all the CVE IDs and their severity?"}],"resultDescription":"Returns a JSON object with the package name, ecosystem, version queried, total vulnerability count, a verdict string (in Spanish), the OSV.dev source attribution, and a detailed list of vulnerabilities each containing GHSA/CVE IDs, aliases, summary, severity level, publication date, and the versions in which the issue was fixed.","failureModes":["Unknown package or ecosystem returns empty vulnerability list","Misspelled ecosystem name may cause lookup failure","Version not found may return all-version vulnerabilities instead of version-specific ones","Rate limiting or payment failure returns error","OSV.dev upstream unavailability causes timeout or empty response"],"whenToPreferThis":"Use this endpoint when you need structured, per-package vulnerability data pulled directly from the authoritative OSV.dev database across a wide range of ecosystems (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Hex, Pub). It is especially useful for automated dependency auditing in CI/CD pipelines, security reviews, or when building an agent that needs to assess whether a specific package version is safe to use, without requiring access to a local vulnerability scanner or a GitHub token.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T00:41:51.195Z","isFirstParty":false,"canonicalSlug":"vextorium-package-vulnerability-lookup-8df8737b"}