{"uid":"cap_fZ_o4G6L8Sh9CoWsKYZh2","slug":"stack-facts-package-security-metadata-lookup-f87e9ad4","name":"Stack Facts Package Security & Metadata Lookup","description":"Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.","url":"https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/package/%7Becosystem%7D/%7Bname%7D?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","properties":{"properties":{"type":"string"}}},"responseSchema":{"type":"json","example":{"data":{"name":"request","purl":"pkg:npm/request@2.88.2","notice":"request has been deprecated, se…","yanked":false,"licence":{"from":"license","name":"Apache License 2.0","spdx":"Apache-2.0","declared":"Apache-2.0","fsf_libre":true,"osi_approved":true,"deprecated_id":false},"version":"2.88.2","homepage":"https://github.com/request/requ…","requires":{"node":">= 6"},"ecosystem":"npm","is_latest":true,"deprecated":true,"repository":"https://github.com/request/requ…","published_at":"2020-02-11T16:35:36.122Z","registry_url":"https://www.npmjs.com/package/r…","latest_version":"2.88.2","versions_count":3,"latest_published_at":"2020-02-11T16:35:36.122Z"},"meta":{"stale":false,"notice":"Normalised (modified) from the …","source":"https://registry.npmjs.org/","dataset":"package","licences":"/licences","attribution":"Package metadata from the npm r…","retrieved_at":"2026-10-09T07:00:00.000Z","spdx_list_version":"3.29.0"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ftTObMiKTs2iRwXNjdStd","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns security, vulnerability, deprecation, license, and end-of-life metadata for a software package by ecosystem and name, paid per-call in USDC via x402.","exampleAgentPrompt":"Before I install the npm package 'request', can you check if it has any known vulnerabilities, CVEs, malware issues, or deprecation warnings using Stack Facts?","exampleUseCases":[{"title":"Pre-install dependency security check","prompt":"I'm about to add 'lodash' from npm to my project — can you check if it has any known vulnerabilities, exploited CVEs, or is end-of-life before I install it?"},{"title":"License compliance audit for a package","prompt":"What license does the PyPI package 'requests' use, and is it OSI-approved? I need to make sure it's compatible with our commercial project."},{"title":"Detecting deprecated packages in a codebase","prompt":"Check whether the npm package 'request' at version 2.88.2 is deprecated and if there are any active security vulnerabilities I should know about."}],"resultDescription":"A JSON object containing the package's name, ecosystem, PURL, version info, deprecation and yanked status, license details (SPDX, FSF/OSI flags), homepage, repository, published dates, plus security signals from OSV vulnerabilities and CISA KEV exploited CVEs, and provenance/attribution metadata.","failureModes":["Package or ecosystem not found — returns 404 or empty data","Invalid ecosystem parameter — unrecognized ecosystem strings may fail","Payment not accepted — x402 payment flow failure results in 402 response","Stale data — meta.stale flag may be true if upstream data is outdated","Network timeout — upstream registry or OSV API unavailable"],"whenToPreferThis":"Choose this endpoint when an AI agent needs machine-readable, signed, authoritative security and license metadata about an open source package without setting up an account or API key. It is ideal for automated dependency vetting pipelines, CI/CD security gates, or agent workflows where micropayment-per-call (USDC via x402) is acceptable and trusted signed answers are required. Prefer this over scraping package registries directly or using unauthenticated OSV APIs when you need aggregated, normalized data (malware + CVE + CISA KEV + EOL + license) in a single call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-19T06:41:17.492Z","isFirstParty":false,"canonicalSlug":"stack-facts-package-security-metadata-lookup-f87e9ad4"}