{"uid":"cap_dVAYrV5Qudq2C6cAAm-ha","slug":"package-security-metadata-lookup-npm-pypi-crates-io-b77554b8","name":"Package Security & Metadata Lookup (npm, PyPI, crates.io)","description":"Signed evidence about web pages, for AI agents. Ask whether a quote appears on a page or check every citation in an answer at once, fetch a page and learn…","url":"https://vehcdj664efetfrsolne5umanq.srv.us/v1/check/packages?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"packages":{"type":"array","items":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name as you would install it (npm names may be scoped: @scope/name)."},"version":{"type":"string","maxLength":64,"description":"Optional: the version you will install (e.g. a pinned 4.17.20). Advisories are then listed for this version; without it, for the latest."},"ecosystem":{"enum":["npm","pypi","crates"],"type":"string"}},"additionalProperties":false},"maxItems":10,"minItems":1,"description":"1 to 10 packages to look up. Each is { ecosystem, name, version? }; ecosystem is npm, pypi or crates (crates.io)."}}},"responseSchema":{"type":"json","example":{"note":"exists means the registry listed this name when we looked. It is not a security verdict: the package may still be malicious, unmaintained or not the one you meant; description and licence are the publisher's own text. vulnerabilities lists known OSV.dev advisories for the version shown (the one you sent, else the latest; name only when the registry does not list the name and no version was sent); none listed does not mean the package has no flaws, and advisory summaries are third-party text. Vulnerability data: OSV.dev (GitHub Advisory Database and PyPI Advisory Database, CC-BY 4.0; RustSec, CC0; OpenSSF Malicious Packages, Apache 2.0), see https://github.com/advisories.","tier":"paid","receipt":"eyJ…","results":[{"name":"left-pad","exists":true,"status":"found","yanked":null,"license":"WTFPL","signals":["deprecated"],"homepage":"https://github.com/stevemao/left-pad#readme","ecosystem":"npm","created_at":"2014-03-14T09:09:20.762Z","deprecated":"use String.prototype.padStart()","raw_sha256":"…","repository":"git+ssh://git@github.com/stevemao/left-pad.git","description":"String left pad","registry_url":"https://www.npmjs.com/package/left-pad","latest_version":"1.3.0","vulnerabilities":{"count":0,"items":[],"reason":null,"status":"checked","version":"1.3.0","truncated":false}}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-4Nru0c3H5SCiRYTi6P2U","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks 1–10 npm, PyPI, or crates.io packages for existence, metadata, deprecation status, and known OSV.dev vulnerability advisories","exampleAgentPrompt":"Check whether the npm packages 'lodash' version 4.17.20 and 'left-pad' have any known vulnerabilities or are deprecated, and tell me their licenses.","exampleUseCases":[{"title":"Dependency audit before shipping","prompt":"Before I merge this PR, can you check these three npm packages for known security advisories: axios 1.4.0, express 4.18.2, and jsonwebtoken 9.0.0?"},{"title":"Vetting an unfamiliar PyPI library","prompt":"I found a Python package called 'pycryptodome' — can you look it up on PyPI and tell me if it's legit, what license it uses, and whether there are any known vulnerabilities?"},{"title":"Checking a Rust crate before pinning","prompt":"We're about to pin 'tokio' version 1.28.0 from crates.io in our Rust project — can you check if it has any known security advisories and whether it's still actively maintained?"}],"resultDescription":"Returns a JSON array of results per package, each including: existence status (found/not found), latest or requested version, license, deprecation notice if any, creation date, repository and homepage URLs, registry URL, and a vulnerabilities object listing OSV.dev advisory count and items for the checked version. Also includes a signed receipt and advisory data attribution.","failureModes":["Package name not found in registry — returns exists: false with status 'not found'","Invalid ecosystem value (not npm/pypi/crates) — request validation error","More than 10 packages submitted — rejected by minItems/maxItems constraint","Payment failure via x402 protocol — 402 response before data is returned","Version string longer than 64 characters — validation error","Advisory data temporarily unavailable from OSV.dev — vulnerabilities status may reflect partial data"],"whenToPreferThis":"Use this endpoint when you need a quick, paid, signed lookup of package security and metadata from a neutral third-party service covering npm, PyPI, and crates.io in a single call. Prefer it over manual registry scraping when you need OSV advisory data bundled with package metadata, or when you need a signed receipt for auditability. Best for agents doing dependency vetting, CI/CD pre-checks, or security reviews where up to 10 packages need to be assessed at once.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-17T12:40:33.115Z","isFirstParty":false,"canonicalSlug":"package-security-metadata-lookup-npm-pypi-crates-io-b77554b8"}