{"uid":"cap_eRrSGnGJS95zNdE_PSbmc","slug":"surefact-package-vulnerability-checker-2f2f4a14","name":"Surefact Package Vulnerability Checker","description":"Verified, pay-per-call tools for AI agents: read web pages, check emails, audit DNS and domains, convert currencies, vet package versions for vulnerabilities, and roll provably fair dice for games. Every answer is checked against its source or comes with a proof. No signup or API key: pay each call in USDC on Base with x402. Failed calls are never charged.","url":"https://api.surefact.workers.dev/v1/package?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name (Go: module path; Packagist: vendor/package)."},"version":{"type":"string","description":"Version to check for deprecation and vulnerabilities (default: latest). A tag or branch (npm dist-tag, Go branch) is reported as the version it resolves to."},"ecosystem":{"enum":["npm","pypi","crates","rubygems","go","nuget","packagist"],"type":"string","description":"Package ecosystem."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"name":"lodash","advice":"Upgrade to 4.18.0 or later (fixes 4 advisories: 2 high, 2 moderate). Latest 4.18.1 has no known advisories.","exists":true,"latest":"4.18.1","yanked":false,"install":"npm install lodash@4.17.15","version":"4.17.15","ecosystem":"npm","checked_at":"2026-10-13T12:00:00.000Z","deprecated":false,"install_safe":"npm install lodash@4.18.0","registry_url":"https://www.npmjs.com/package/lodash","safe_upgrade":"4.18.0","vulnerabilities":[{"id":"GHSA-r5fr-rjxr-66jc","url":"https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-35jh-r3h4-6jhm"],"summary":"lodash vulnerable to Code Injection via `_.template` imports key names","fixed_in":"4.18.0","severity":"high","published":"2026-04-01","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","fixed_in_by_id":{"GHSA-35jh-r3h4-6jhm":"4.17.21","GHSA-r5fr-rjxr-66jc":"4.18.0"}},{"id":"GHSA-p6mc-m468-83gw","url":"https://osv.dev/vulnerability/GHSA-p6mc-m468-83gw","aliases":["CVE-2020-8203"],"summary":"Prototype Pollution in lodash","fixed_in":"4.17.19","severity":"high","published":"2020-07-15","cvss_score":7.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"id":"GHSA-f23m-r3pf-42rh","url":"https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-xxjr-mmjv-4gpg"],"summary":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","fixed_in":"4.18.0","severity":"moderate","published":"2026-04-01","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","fixed_in_by_id":{"GHSA-f23m-r3pf-42rh":"4.18.0","GHSA-xxjr-mmjv-4gpg":"4.17.23"}},{"id":"GHSA-29mw-wpgm-hmr9","url":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","fixed_in":"4.17.21","severity":"moderate","published":"2022-01-06","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"vulnerability_count":4,"latest_vulnerability_count":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_54jQjqmAayVlMfURDxeYF","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a package version across npm, PyPI, Crates, RubyGems, Go, NuGet, or Packagist for known vulnerabilities, deprecation, and upgrade advice","exampleAgentPrompt":"Can you check if lodash 4.17.15 on npm has any known vulnerabilities and tell me what version I should upgrade to?","exampleUseCases":[{"title":"Audit dependency before production deploy","prompt":"Before we ship, check if requests 2.28.0 on PyPI has any known security vulnerabilities or CVEs, and tell me the safest version to use."},{"title":"Screen new open source package","prompt":"We're thinking of adding the 'serde' crate version 1.0.150 to our Rust project — does it have any known vulnerabilities or is it deprecated?"},{"title":"Identify safe upgrade path for CI pipeline","prompt":"Our CI is flagging an old version of express on npm — can you check what vulnerabilities exist in express 4.17.1 and what version fixes them all?"}],"resultDescription":"Returns a JSON object with the package name, ecosystem, checked version, latest version, deprecation status, yanked status, list of vulnerabilities (each with GHSA/CVE ID, severity, CVSS score, summary, and fixed-in version), a recommended safe upgrade version, safe install command, registry URL, and an advice string summarizing what action to take. Failed calls are never charged.","failureModes":["Package not found in the specified ecosystem — exists field returns false","Unknown or unsupported ecosystem value returns a validation error","Version string not found or unresolvable tag/branch — falls back to latest","Network or registry timeout returning a 5xx with no charge","Malformed query parameters return a 400 error"],"whenToPreferThis":"Choose this endpoint when you need verified, source-checked vulnerability data for a specific package version across the major ecosystems (npm, PyPI, Crates, RubyGems, Go, NuGet, Packagist) without setting up an API key. It is ideal for AI agents performing automated dependency audits inside CI/CD workflows, code review assistants, or any agent that needs actionable upgrade advice with proof. Prefer it over generic LLM knowledge when freshness and verifiability matter, since results are checked against live registries and OSV advisories.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-14T12:30:03.625Z","isFirstParty":false,"canonicalSlug":"surefact-package-vulnerability-checker-2f2f4a14"}