{"uid":"cap_VU4gHK5bFKOBQ8XGGZCBv","slug":"stack-facts-osv-package-vulnerability-check-acc14499","name":"Stack Facts OSV Package Vulnerability Check","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/osv/check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"format":{"enum":["package-lock.json","yarn.lock","requirements.txt","poetry.lock"],"type":"string"},"lockfile":{"type":"string","minLength":1},"packages":{"type":"array","items":{"type":"string","pattern":"^pkg:","maxLength":512,"minLength":7},"maxItems":50,"minItems":1}}},"responseSchema":{"type":"json","example":{"data":{"count":2,"results":[{"kev":false,"name":"lodash","purl":"pkg:npm/lodash@4.17.20","status":"affected","version":"4.17.20","ecosystem":"npm","malicious":false,"advisories":[{}]}],"summary":{"in_kev":1,"affected":2,"packages":2,"malicious":0,"advisories":2,"unanswered":0,"versions_unknown":0,"no_known_advisories":0},"kev_catalog_version":"2026.10.10"},"meta":{"stale":false,"notice":"Normalised (modified) from the …","dataset":"osv","datasets":{"kev":{},"osv":{}}}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oNFEvOfAWLqgI9XiNaHiy","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks one or more packages (via PURL, lockfile) for malware, OSV vulnerabilities, CISA KEV exploited CVEs, and end-of-life status, returning signed results paid per-call in USDC","exampleAgentPrompt":"Before I install lodash@4.17.20 from npm, can you check if it has any known vulnerabilities, whether it appears in the CISA exploited CVEs list, or if it's been flagged as malicious?","exampleUseCases":[{"title":"Pre-install npm package safety check","prompt":"I'm about to add express@4.18.2 and lodash@4.17.20 to my project — can you check both npm packages for known vulnerabilities, exploited CVEs, and any malware flags before I install them?"},{"title":"Lockfile audit for CI pipeline","prompt":"Here's my requirements.txt — can you scan all the packages in it for OSV vulnerabilities and tell me which ones are in the CISA Known Exploited Vulnerabilities catalog so I can prioritize patching?"},{"title":"Verify dependency safety before deployment","prompt":"I need to audit my yarn.lock before deploying to production — run it through the vulnerability checker and give me a summary of anything affected, especially anything with HIGH or CRITICAL severity or that's actively being exploited in the wild."}],"resultDescription":"Returns per-package results including: vulnerability advisories with CVE aliases, severity labels, fixed versions, KEV flag, malicious flag, and ecosystem; plus a summary with counts of affected packages, KEV hits, malicious packages, and total advisories; plus signed dataset metadata (OSV snapshot ID, KEV catalog version, SHA256, signature) confirming data freshness and provenance.","failureModes":["Invalid PURL format causes validation error — PURLs must start with 'pkg:'","Lockfile format mismatch — submitted lockfile content does not match declared format enum","Package version not found in OSV — returns no advisories but does not error","Stale dataset flag set to true if OSV or KEV data is older than cadence window","Payment failure or insufficient USDC balance returns HTTP 402","Empty packages array or missing required fields returns 400 validation error","Network timeout for large lockfiles with many packages"],"whenToPreferThis":"Choose this endpoint when you need cryptographically signed, pay-per-call vulnerability data with no account setup — ideal for AI agents doing automated dependency audits in CI/CD pipelines, pre-install checks, or supply chain risk assessments. Prefer it over free OSV API wrappers when you need combined OSV + CISA KEV + malware signals in a single call, signed responses for auditability, and when operating without persistent API keys. Best for spot checks of up to 50 packages per call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:45:09.023Z","isFirstParty":false,"canonicalSlug":"stack-facts-osv-package-vulnerability-check-acc14499"}