{"uid":"cap_RYsr19Al-YXE3r1IBMrjy","slug":"agent-data-tools-package-security-audit-703d8fed","name":"Agent Data Tools – Package Security Audit","description":"Read public static documentation as text or Markdown with code, tables, headings and links for $0.002 USDC on Base via x402. Inspect real cached examples and an unsigned quote, then buy with a capped Node CLI. No account or API key. No JavaScript rendering, authenticated or paywalled access. Other paid utilities remain available.","url":"https://agent-data-tools.revmesh2074.workers.dev/package-audit?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["packages"],"properties":{"packages":{"type":"string","description":"Comma-separated ecosystem:name items, optionally name@exact-version; max 10. For scoped npm, use npm:@scope/name@version."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"source":"deps.dev","checked":1,"results":[{"name":"minimist","flags":["known-vulnerabilities"],"exists":true,"source":"deps.dev","verdict":"caution","version":"1.2.5","ecosystem":"npm","advisories":[],"advisoryIds":["GHSA-xvch-5gv4-984h"],"retrievedAt":"2026-10-14T12:00:00.000Z","versionExists":true,"weeklyDownloads":null,"versionAdvisories":{"note":"OSV advisories are matched to this exact package version.","source":"OSV","status":"complete","retrievedAt":"2026-10-14T12:00:00.000Z","advisoryCount":1,"vulnerabilities":[{"id":"GHSA-xvch-5gv4-984h","epss":{"note":"EPSS estimates 30-day exploitation probability for CVE aliases; it is not a package-safety guarantee. Null scores are unknown, not zero.","scores":[{"cve":"CVE-2021-44906","date":"2026-10-14","score":0.04581,"status":"available","percentile":0.91484}],"source":"FIRST EPSS","status":"complete","retrievedAt":"2026-10-14T12:00:00.000Z","sourceStatus":"available"},"source":"OSV","aliases":["CVE-2021-44906"],"summary":"Prototype Pollution in minimist","modified":"2026-03-13T22:11:59.523514Z","published":"2022-03-18T00:01:09Z","sourceUrl":"https://osv.dev/vulnerability/GHSA-xvch-5gv4-984h","rangeStatus":"reported","retrievedAt":"2026-10-14T12:00:00.000Z","detailStatus":"available","fixedVersionRanges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.2.6"}],"fixedVersions":["1.2.6"]},{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}],"fixedVersions":["0.2.4"]}]}]},"knownVulnerabilities":1,"advisoryDetailsStatus":"not-fetched-subrequest-budget","weeklyDownloadsStatus":"not-fetched-subrequest-budget","advisoryDetailsOmitted":1,"advisoryDetailsUnavailable":0,"knownVulnerabilityCountSources":["deps.dev","OSV"]}],"summary":"All 1 package(s) exist. Review each verdict and flags before installing.","notFound":0,"epssLookup":{"note":"FIRST EPSS estimates 30-day exploitation probability, not package safety.","source":"FIRST EPSS","status":"complete","omittedCves":0,"queriedCves":1,"retrievedAt":"2026-10-14T12:00:00.000Z","sourceStatus":"available","malformedRows":0,"requestedCves":1,"returnedScores":1,"uninspectedAdvisoryDetails":0},"lookupFailed":0,"versionNotFound":0,"versionAdvisoryLookupIncomplete":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.2","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.2/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2wbtVYYew0A6Fzpkyppr6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.2","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits npm (and other ecosystem) packages for known vulnerabilities, advisories, and risk verdicts using deps.dev and OSV data","exampleAgentPrompt":"Can you check whether minimist@1.2.5 and lodash@4.17.20 have any known security vulnerabilities or CVEs I should be worried about before I use them in my project?","exampleUseCases":[{"title":"Pre-deploy dependency security check","prompt":"Before I ship this release, audit these npm packages for vulnerabilities: npm:express@4.18.2, npm:axios@1.4.0, npm:minimist@1.2.5 — tell me if any have known CVEs and what the safe fixed versions are."},{"title":"CI pipeline package gating","prompt":"Check whether npm:serialize-javascript@3.1.0 and npm:ejs@3.1.6 are safe to use — I need their vulnerability verdicts and EPSS exploitation scores so I can decide whether to block the build."},{"title":"Open source library vetting","prompt":"I'm evaluating npm:jsonwebtoken@8.5.1 as a dependency — does it have any prototype pollution or other security advisories on OSV, and is there a patched version available?"}],"resultDescription":"A JSON object containing per-package results with: existence confirmation, vulnerability verdict (e.g. 'caution'), known vulnerability count, list of GHSA/CVE advisory IDs with summaries and published dates, EPSS exploitation probability scores per CVE, fixed version ranges from OSV, weekly download stats where available, and an overall summary string. Source attribution includes deps.dev and OSV.","failureModes":["Package not found in registry — result includes exists:false","Invalid ecosystem prefix — query param rejected","More than 10 packages requested — likely truncated or errored","Version not found — versionExists:false returned","EPSS or advisory detail budget exceeded — fields marked not-fetched-subrequest-budget","Malformed packages query param — 402/400 error before audit runs","Network timeout from upstream deps.dev — partial results"],"whenToPreferThis":"Use this endpoint when you need fast, structured security audit data for up to 10 packages at once without requiring an API key or account. It combines deps.dev and OSV data with EPSS exploitation probability in a single call, making it ideal for CI/CD pipeline checks, pre-install vetting, or AI agent workflows that need to make install/block decisions programmatically. Prefer this over manual OSV or NVD lookups when you want a single verdict per package with cross-referenced advisory IDs and fix recommendations.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-16T12:34:51.342Z","isFirstParty":false,"canonicalSlug":"agent-data-tools-package-security-audit-703d8fed"}