{"uid":"cap_dImntklc07vutE5GAbd39","slug":"safe-upgrade-decision-api-npm-malicious-scan-6ebebaf6","name":"Safe Upgrade Decision API – npm Malicious Scan","description":"Evidence-backed npm package upgrade decisions for coding agents.","url":"https://x402-safe-upgrade-api.onrender.com/v1/malicious-scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"version":{"type":"string","description":"Exact version; omit for latest."},"packageName":{"type":"string","description":"Exact npm package name."}}},"responseSchema":{"type":"json","example":{"verdict":"REVIEW BEFORE INSTALLING","riskScore":35}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_GjKnz1MAuNqmpnhU2HL35","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans an npm package (and optional version) for malicious activity and returns an evidence-backed upgrade verdict with a risk score.","exampleAgentPrompt":"Before I install it, can you scan the npm package 'lodash' version '4.17.21' for malicious activity and tell me if it's safe to upgrade to?","exampleUseCases":[{"title":"Automated dependency upgrade safety check","prompt":"I'm about to upgrade 'express' to version '4.18.2' in my project — can you scan it for any malicious behavior or known risks before I do?"},{"title":"New package vetting before first install","prompt":"I want to add 'axios' to my project but I've never used it before — can you check if the latest version is safe and not flagged as malicious?"},{"title":"CI pipeline pre-install security gate","prompt":"Before my build pipeline installs 'webpack' version '5.88.0', run a malicious scan on it and tell me the risk score and verdict so I can decide whether to block the install."}],"resultDescription":"Returns a JSON object with a 'verdict' string (e.g. 'REVIEW BEFORE INSTALLING', 'SAFE', 'MALICIOUS') and a 'riskScore' integer (0–100), where higher scores indicate greater risk. The verdict provides an actionable recommendation and the risk score gives a quantitative measure of potential danger.","failureModes":["Unknown package name returns an error or null verdict","Specific version not found in registry causes a lookup failure","Network timeout if the upstream npm registry or threat intelligence feeds are slow","Invalid input schema (missing packageName) returns a 400-level error","Very new packages may have insufficient data for a confident verdict"],"whenToPreferThis":"Choose this endpoint when an AI coding agent needs an automated, evidence-backed go/no-go signal before installing or upgrading an npm package, especially in automated CI/CD pipelines or agentic workflows where human review is not practical. It is particularly valuable for catching malicious packages that may pass basic audit checks, and for getting a quantitative risk score rather than a simple binary safe/unsafe flag.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T20:25:59.655Z","isFirstParty":false}