{"uid":"cap_Z1RQ9hT1kbka6VNW-cU3B","slug":"package-trust-score-safety-signals-5fd6b77a","name":"Package Trust Score & Safety Signals","description":"Install-safety signals for an npm or PyPI package: registry metadata, install-script usage, OSV advisories, typosquat risk, and a 0-100 trust score.","url":"https://x402-api-24223879872.us-east1.run.app/v1/package-trust?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name"},"ecosystem":{"enum":["npm","pypi"],"type":"string"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"name":{"type":"string"},"flags":{"type":"array","items":{"type":"string"}},"score":{"type":"number"},"registry":{"type":"object","properties":{"exists":{"type":"boolean"},"ageDays":{"type":"number"},"license":{"type":["string","null"]},"deprecated":{"type":"boolean"},"latestVersion":{"type":"string"},"maintainerCount":{"type":"number"},"firstPublishedAt":{"type":"string"},"latestPublishedAt":{"type":"string"}}},"ecosystem":{"type":"string"},"typosquat":{"type":"object","properties":{"matches":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"distance":{"type":"number"}}}}}},"advisories":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}},"count":{"type":"number"},"maxSeverity":{"type":["string","null"]}}},"installScripts":{"type":"object","nullable":true,"properties":{"install":{"type":"boolean"},"preinstall":{"type":"boolean"},"postinstall":{"type":"boolean"}}}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_c1vDtbGvZ8naD22A-r4p2","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns install-safety signals for an npm or PyPI package, including registry metadata, install-script usage, OSV advisories, typosquat risk, and a 0-100 trust score.","exampleAgentPrompt":"Can you check whether the npm package 'colors' is safe to install — I want to see its trust score, any known advisories, whether it uses install scripts, and if there's any typosquat risk?","exampleUseCases":[{"title":"Vetting a new dependency before install","prompt":"Before I add 'requests' from PyPI to our project, can you run a safety check on it — I want the trust score, any CVEs or OSV advisories, and whether it has preinstall or postinstall scripts?"},{"title":"Supply chain audit for CI pipeline","prompt":"We're building a security gate for our CI pipeline. Can you check the npm package 'lodash' for typosquat risk, install script usage, and overall trust score so we can decide whether to flag it?"},{"title":"Detecting a suspicious lookalike package","prompt":"Someone on my team installed 'reqqests' from PyPI — can you check if it's legitimate or a typosquat of 'requests', and give me the full trust score and any red flags?"}],"resultDescription":"A JSON object containing: a 0-100 trust score, boolean flags array listing detected issues, registry metadata (age, license, deprecation status, maintainer count, publish dates, latest version), install script usage (preinstall, install, postinstall booleans), OSV advisories (count, IDs, max severity), and typosquat matches with edit distances.","failureModes":["Package name not found in the specified ecosystem — returns empty or low-confidence result","Invalid ecosystem value (must be 'npm' or 'pypi') — returns validation error","OSV or registry API upstream timeout — partial data may be returned","Typosquat detection may produce false positives for intentionally short or similar package names","Newly published packages may have incomplete registry metadata"],"whenToPreferThis":"Choose this endpoint when you need a holistic, multi-signal safety assessment of an npm or PyPI package before installation or inclusion in a dependency tree. It combines registry metadata, vulnerability advisories, typosquat detection, and install-script auditing into a single scored response — ideal for automated CI/CD gates, dependency review workflows, or agent-driven security pipelines where you need a single trust number plus actionable flags rather than querying OSV, npm, and PyPI registries separately.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T06:33:47.980Z","isFirstParty":false,"canonicalSlug":"package-trust-score-safety-signals-5fd6b77a"}