{"uid":"cap_X7iyt7OsXO8IFojvHD6eh","slug":"1gateway-package-vulnerability-check-f99969e9","name":"1gateway Package Vulnerability Check","description":"Use when an agent must check a dependency before installing or upgrading: is this exact package version vulnerable? Input: package, ecosystem (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist...), version. Output: JSON vulnerable yes/no, counts by severity, advisories (GHSA/CVE id, summary, severity, CVSS, CWE, fixed versions, links). Data: OSV.dev. Example: ?package=lodash&ecosystem=npm&version=4.17.15","url":"https://1gateway.dev/v1/dev/vulnerabilities?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["package","ecosystem","version"],"properties":{"package":{"type":"string","examples":["lodash"],"maxLength":214,"description":"Package name as in its registry (Go: module path; Maven: group:artifact)"},"version":{"type":"string","examples":["4.17.15"],"maxLength":64,"description":"Exact released version"},"ecosystem":{"enum":["npm","PyPI","Go","Maven","crates.io","NuGet","RubyGems","Packagist","Pub","Hex","Hackage","CRAN","SwiftURL"],"type":"string","examples":["npm"],"description":"Package ecosystem (case-insensitive; pip/python, cargo/rust, composer, gem also accepted)"}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["package","vulnerable","count","bySeverity","fixedVersionsMentioned","vulnerabilities","truncated","attribution","note"],"properties":{"note":{"type":"string"},"count":{"type":"integer"},"package":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"ecosystem":{"type":"string"}}},"truncated":{"type":"boolean"},"bySeverity":{"type":"object","properties":{"low":{"type":"integer"},"high":{"type":"integer"},"unknown":{"type":"integer"},"critical":{"type":"integer"},"moderate":{"type":"integer"}}},"vulnerable":{"type":"boolean"},"attribution":{"type":"string"},"vulnerabilities":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"cve":{"type":["string","null"]},"cwe":{"type":"array","items":{"type":"string"}},"url":{"type":"string"},"cvss":{"type":["object","null"],"properties":{"type":{"type":"string"},"vector":{"type":"string"}}},"aliases":{"type":"array","items":{"type":"string"}},"fixedIn":{"type":"array","items":{"type":"string"}},"summary":{"type":["string","null"]},"advisory":{"type":["string","null"]},"modified":{"type":["string","null"]},"severity":{"type":["string","null"]},"published":{"type":["string","null"]}}}},"fixedVersionsMentioned":{"type":"array","items":{"type":"string"}}}}}}}},"responseSchema":{"type":"json","example":{"note":"Advisories that list this exact version as affected (withdrawn ones removed). fixedIn = first fixed version per affected range; pick the lowest one above your …","count":6,"package":{"name":"lodash","version":"4.17.15","ecosystem":"npm"},"truncated":false,"bySeverity":{"low":0,"high":3,"unknown":0,"critical":0,"moderate":3},"vulnerable":true,"attribution":"Vulnerability data from OSV.dev (https://osv.dev), CC BY 4.0, aggregating GitHub Advisory Database, PyPA, Go, RustSec and other sources.","vulnerabilities":[{"id":"GHSA-r5fr-rjxr-66jc","cve":"CVE-2026-4800","cwe":["CWE-94"],"url":"https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc","cvss":{"type":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"aliases":["CVE-2026-4800"],"fixedIn":["4.18.0"],"summary":"lodash vulnerable to Code Injection via `_.template` imports key names","advisory":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","modified":"2026-10-17T02:56:15.633068434Z","severity":"HIGH","published":"2026-04-01T23:51:12Z"}],"fixedVersionsMentioned":["4.18.0"]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_qzYX9l1zlFHeATsabhDhc","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether an exact package version is vulnerable by querying OSV.dev, returning severity counts and advisory details (GHSA/CVE IDs, CVSS, CWEs, fixed versions).","exampleAgentPrompt":"Before I upgrade, check whether lodash version 4.17.15 on npm has any known security vulnerabilities — I need the severity breakdown and any CVE or GHSA IDs with their fixed versions.","exampleUseCases":[{"title":"Pre-install security gate for npm packages","prompt":"I'm about to add express 4.18.1 from npm to my project — can you check if that exact version has any known vulnerabilities and tell me the severity counts and whether there's a safe version to use instead?"},{"title":"CI/CD pipeline dependency scan","prompt":"We're running a deployment pipeline and need to verify that PyPI package requests version 2.28.0 has no known CVEs or security advisories before we ship — can you check OSV.dev for us?"},{"title":"Audit legacy Go module for security issues","prompt":"We have a legacy service pinned to Go module golang.org/x/crypto version 0.0.0-20210711020723 — can you check if that version has any known vulnerabilities, what their CVSS scores are, and what version we should upgrade to?"}],"resultDescription":"A JSON object with: a `vulnerable` boolean, total `count` of matching advisories, `bySeverity` breakdown (critical/high/moderate/low/unknown), and a `vulnerabilities` array where each item includes GHSA/CVE IDs, summary, severity, CVSS vector, CWE list, fixed versions, and advisory URLs. Also includes the package echo (name, version, ecosystem) and an OSV.dev attribution string.","failureModes":["Unknown ecosystem value returns validation error — must use supported enum values","Package not found in the specified ecosystem returns empty vulnerability list (not an error)","Exact version string mismatch (e.g. using 'v1.2.3' vs '1.2.3') may return no results","Result may be truncated for packages with very large numbers of advisories (truncated: true)","Network or OSV.dev upstream downtime returns a gateway/service error","Payment failure (x402) if USDC balance insufficient"],"whenToPreferThis":"Choose this endpoint when you need a quick, single-version vulnerability check against OSV.dev data without running a full dependency scanner locally. Ideal for agentic workflows that gate installation, deployment, or PR merges on security status. Covers a broader ecosystem range than GitHub's native Dependabot alerts for non-GitHub-hosted projects, and returns structured JSON suitable for downstream decision-making without parsing HTML advisories.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T06:46:22.293Z","isFirstParty":false,"canonicalSlug":"1gateway-package-vulnerability-check-f99969e9"}