{"uid":"cap_axbegF75Yt_99_sfc63-G","slug":"paket-dependency-confusion-checker-d0d9cbf1","name":"Paket Dependency Confusion Checker","description":"Takes the names your organisation publishes internally and checks each against the public registry of the same ecosystem. Three findings, kept apart because they call for different actions. Name is free: nobody has taken it, the door is open but unattended, and the answer is to reserve the name yourself. Name is taken and old: probably an unrelated project that happens to share the name, worth confirming but rarely urgent.","url":"https://paket.halowerk.com/v1/dependency-confusion","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"system":{"enum":["npm","pypi","maven","go","cargo","nuget","rubygems"],"type":"string"},"packages":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":300,"minLength":1},"internal_version":{"type":"string","maxLength":60}},"additionalProperties":false},"maxItems":60,"minItems":1,"description":"Your internal package names, optionally with the internal version."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_8d4m8MtS81AFl-untCasW","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks internally-used package names against public registries to detect dependency confusion vulnerabilities — flagging names that are unclaimed, taken by unrelated parties, or otherwise at risk.","exampleAgentPrompt":"Check these internal package names — @acme/auth-client, @acme/data-layer, and @acme/ui-kit — against the public npm registry and tell me which ones are unclaimed (so we should register them) and which are already taken by unrelated projects.","exampleUseCases":[{"title":"Pre-release supply chain audit","prompt":"Before we open-source our platform, check all our internal npm package names — acme-core, acme-utils, acme-api-client — against the public registry and flag any that are already taken by someone else or dangerously unclaimed."},{"title":"Security team dependency confusion scan","prompt":"Our security team wants to know if any of our private PyPI packages are vulnerable to dependency confusion — run these names through the public index: internal-data-pipeline, acme-ml-utils, acme-reporting-lib."},{"title":"Proactive name reservation check","prompt":"We're about to start a new microservices project and want to reserve our package names on npm before publishing. Can you check whether acme-gateway, acme-session, and acme-config are currently unclaimed so we know which ones to register now?"}],"resultDescription":"Returns a structured set of findings split into distinct categories: names that are free (unclaimed on the public registry, candidate for reservation), names that are taken by an apparently unrelated project (potential confusion risk to investigate), and any additional risk signals. Each finding includes the package name, ecosystem, and recommended action.","failureModes":["Unknown or unsupported ecosystem returns a validation error","Rate limiting if a large batch of names is submitted rapidly","Registry lookup timeouts if the upstream public registry is slow or unavailable","Ambiguous ecosystem specification may return results for the wrong registry","Empty or malformed name list returns a 400-level error"],"whenToPreferThis":"Use this endpoint when you need to specifically assess dependency confusion risk — i.e., when the question is whether internal package names are safely distinct from public registry entries. Prefer it over generic package lookup endpoints when you have a list of internally-used names and want a security-focused, categorized finding rather than raw registry data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:34:44.075Z","isFirstParty":false}