{"uid":"cap_fJd3jDl_xcKRfK95a-E67","slug":"pkgpulse-vulnerability-check-1be88b20","name":"pkgpulse Vulnerability Check","description":"Dependency intelligence for AI coding agents, paid per-call via x402 (USDC on Base): npm package health scores with a disclosed rubric, typosquat checks, dependency audits, OSV known-vulnerability scans (npm, PyPI, Go, crates.io, Maven and more) and PyPI preflight checks. Free index at /, free sample at /api/sample.","url":"https://pkgpulse.letom1176.workers.dev/api/vuln-check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"Package name, e.g. lodash, @babel/core, requests, github.com/gin-gonic/gin"},"purl":{"type":"string","description":"Alternative to name/version/ecosystem: a package URL, e.g. pkg:pypi/requests@2.19.0"},"version":{"type":"string","description":"Exact version or range (^4.17.0, >=2.28,<3). Omit for latest (npm, PyPI)"},"ecosystem":{"type":"string","description":"npm (default), pypi, go, crates, maven, nuget, rubygems, packagist, pub, hex"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"name":"lodash","counts":{"low":0,"high":3,"total":6,"medium":3,"critical":0},"latest":"4.18.1","verdict":"vulnerable","headline":"lodash@4.17.15: 6 known vulnerabilities (3 high, 3 medium). Upgrade to 4.18.0 or later.","ecosystem":"npm","upgrade_to":"4.18.0","version_checked":"4.17.15","vulnerabilities":[{"id":"GHSA-p6mc-m468-83gw","aliases":["CVE-2020-8203"],"summary":"Prototype Pollution in lodash","fixed_in":"4.17.19","severity":"high","cvss_score":7.4}],"latest_clears_all":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_lw5-kOy1koEyesjSD_FU-","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans a package from npm, PyPI, Go, crates.io, Maven, or other ecosystems against OSV for known CVEs and returns severity counts, upgrade advice, and a plain-English verdict","exampleAgentPrompt":"Check lodash version 4.17.15 on npm for known vulnerabilities and tell me if I need to upgrade and to what version.","exampleUseCases":[{"title":"Pre-install security check for npm package","prompt":"Before I add axios@0.21.1 to my project, check if it has any known CVEs or security issues and tell me the safest version to use instead."},{"title":"PyPI dependency audit before deployment","prompt":"I'm about to deploy with requests==2.19.0 — can you scan it for known vulnerabilities in the PyPI ecosystem and tell me if there's a fixed version?"},{"title":"Go module vulnerability scan","prompt":"Does github.com/gin-gonic/gin have any known security vulnerabilities? Check the latest version and tell me the severity breakdown."}],"resultDescription":"Returns a JSON object with the package name, ecosystem, version checked, latest available version, a verdict ('vulnerable' or 'clear'), a human-readable headline summarizing findings, counts of vulnerabilities by severity (critical/high/medium/low/total), a recommended upgrade version, whether the latest version clears all issues, and a list of individual vulnerabilities each with GHSA/CVE ID, summary, fixed-in version, severity label, and CVSS score.","failureModes":["Unknown package name returns 404 or empty result","Invalid ecosystem value causes a validation error","Version range syntax errors may return unexpected results","Rate limiting or payment failure (x402) returns 402 Payment Required","Packages not yet indexed in OSV may return no vulnerabilities even if issues exist","Very new CVEs may not yet appear in OSV data"],"whenToPreferThis":"Use this endpoint when you need to check a specific package and version (or latest) for known CVEs across major ecosystems including npm, PyPI, Go modules, crates.io, and Maven. It is ideal for per-package pre-install checks, CI gate decisions, or agent-driven dependency triage where you want a structured severity breakdown and upgrade recommendation in a single call. Prefer this over a full dependency audit endpoint when you only need to check one package at a time, or when you have a PURL and want a precise point-in-time vulnerability snapshot with GHSA/CVE detail.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T19:03:54.944Z","isFirstParty":false,"canonicalSlug":"pkgpulse-vulnerability-check-1be88b20"}