{"uid":"cap_hSIcU8-w8T1ZUjvZ5PbaJ","slug":"stormap-package-safety-check-2120ad12","name":"Stormap Package Safety Check","description":"Use when an npm or PyPI package is about to be installed, especially a name an LLM suggested. Returns ok_to_install, caution, dont_install or does_not_exist with reasons: malicious-package reports, known vulnerabilities for the version with the fixed version, deprecated or yanked, age, install scripts, downloads and typosquat look-alikes. From OSV.dev, deps.dev, npm and PyPI. ecosystem=pypi for Python. Errors: 400 bad_input, 502 registry unreachable. Failed calls are not charged.","url":"https://stormap.ai/x402/v1/package_check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"Package name, optionally with a version: \"lodash\", \"lodash@4.17.15\", \"@scope/pkg\", \"requests==2.31.0\"."},"version":{"type":"string","description":"Optional version to check (default: latest)."},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"npm (default) or pypi."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"package":{"type":"string"},"reasons":{"type":"array"},"summary":{"type":"string"},"verdict":{"type":"string"},"ecosystem":{"type":"string"},"similar_to":{},"latest_version":{"type":"string"},"first_published":{"type":"string"},"install_scripts":{"type":"array"},"version_checked":{"type":"string"},"vulnerabilities":{"type":"array"},"weekly_downloads":{"type":["integer","number"]},"malicious_reports":{"type":"array"},"vulnerability_count":{"type":["integer","number"]}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_OYTm5x3LV0HtpbG3_Z8w0","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether an npm or PyPI package is safe to install by analyzing its existence, malicious reports, vulnerabilities, deprecation status, age, install scripts, download counts, and typosquat risks — returning a verdict with reasons.","exampleAgentPrompt":"Is it safe to install the npm package lodash@4.17.15? Check for vulnerabilities, malicious reports, typosquats, and anything sketchy about it.","exampleUseCases":[{"title":"Pre-install security check for a dependency","prompt":"Before I add requests==2.31.0 to my Python project, can you check if it's safe — any known vulnerabilities, malicious reports, or signs it's a typosquat?"},{"title":"Suspicious package name investigation","prompt":"I found a package called 'coIors' on npm — is that a real package or could it be a typosquat of the popular 'colors' library? Check if it's safe."},{"title":"CI pipeline dependency audit","prompt":"We're about to ship and I need to know if express@4.18.2 has any unpatched vulnerabilities or has been flagged as malicious — give me a safety verdict with reasons."}],"resultDescription":"A structured safety verdict (e.g. safe / caution / unsafe) with supporting reasons including: whether the package exists on the registry, any malicious-package reports, known CVEs for the requested version with recommended fix versions, deprecation or yanked status, package age, presence of suspicious install scripts, download volume, and a list of typosquat look-alike package names.","failureModes":["Package name not found on registry — returns not-found verdict","Invalid version specifier format — may return error or fall back to latest","Ambiguous ecosystem — defaults to npm if ecosystem not specified for Python-style names","Rate limiting or payment failure — 402 response requiring x402 payment","Upstream registry API unavailability — may return partial or cached data"],"whenToPreferThis":"Use this endpoint when an agent or developer needs a comprehensive, single-call safety assessment of a specific package before installation — combining vulnerability data, malicious-package intelligence, typosquat detection, and registry metadata in one verdict. Prefer over raw npm audit or PyPI APIs when you need an opinionated, human-readable verdict rather than raw data, or when you need cross-signal analysis (e.g. combining CVEs with install script analysis and typosquat checks).","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T06:33:22.579Z","isFirstParty":false,"canonicalSlug":"stormap-package-safety-check-2120ad12"}