{"uid":"cap_j853Ns98DPV0QtwHWNlF_","slug":"saylor-innovations-data-desk-package-dependency-risk-d4a7dea2","name":"Saylor Innovations Data Desk – Package Dependency Risk","description":"Package dependency risk - deps.dev advisories, license, release age, OpenSSF Scorecard and risk flags for an npm, PyPI, Go, Maven, Cargo or NuGet package","url":"https://saylorinnovations.com/api/registry/deps/npm/:system?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","pathParams"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"pathParams":{"type":"object","required":["system","name"],"properties":{"name":{"type":"string","description":"Package name after the system (maven: group:artifact)"},"system":{"type":"string","description":"npm, pypi, go, maven, cargo or nuget in the path"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object","required":["system","name","risk_level"],"properties":{"name":{"type":"string","description":"Name"},"forks":{"type":["number","null"]},"stars":{"type":["number","null"],"description":"Star count"},"source":{"type":["string","null"],"description":"Data source the values come from"},"system":{"type":"string","description":"Package system"},"licenses":{"type":"array","items":{"type":"string"},"description":"License identifiers"},"advisories":{"type":["array","null"],"description":"Advisories issued"},"checked_at":{"type":["string","null"],"description":"Time the check was run (UTC)"},"deprecated":{"type":["boolean","null"],"description":"True when the package is deprecated"},"risk_flags":{"type":"array","items":{"type":"string"},"description":"Risk flags raised"},"risk_level":{"type":"string","description":"Risk level"},"open_issues":{"type":["number","null"],"description":"Open issues"},"source_repo":{"type":["string","null"],"description":"Source repo"},"published_at":{"type":["string","null"],"description":"Publication time (UTC)"},"advisory_count":{"type":"number","description":"Number of advisory"},"scorecard_date":{"type":["string","null"],"description":"Scorecard date"},"versions_count":{"type":["number","null"],"description":"Number of published versions"},"default_version":{"type":"string","description":"Default version"},"scorecard_overall":{"type":["number","null"],"description":"Scorecard overall"},"days_since_release":{"type":["number","null"],"description":"Days since release"},"scorecard_weak_checks":{"type":["array","null"],"description":"Scorecard weak checks"}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_0pOHsqPPcxyOvZCOm8Gzn","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns security advisories, license info, release age, OpenSSF Scorecard, and risk flags for a package across npm, PyPI, Go, Maven, Cargo, or NuGet ecosystems","exampleAgentPrompt":"Can you pull the dependency risk report for the 'lodash' npm package — I want to see its advisories, license, OpenSSF Scorecard, and any risk flags before we add it to our project?","exampleUseCases":[{"title":"Pre-merge dependency security review","prompt":"Before we merge this PR, can you check the risk level, advisories, and OpenSSF Scorecard for the 'axios' npm package so I know if it's safe to include?"},{"title":"PyPI package license compliance check","prompt":"I need to know the license and any risk flags for the Python package 'requests' on PyPI — we need to make sure it's compatible with our commercial project."},{"title":"Maven artifact deprecation and age check","prompt":"Can you look up the dependency health for the Maven package 'org.apache.commons:commons-lang3' and tell me if it's deprecated, how old the latest release is, and whether there are any known advisories?"}],"resultDescription":"A JSON object containing: package system and name, overall risk level, list of security advisories (with count), license identifiers, OpenSSF Scorecard score and date, risk flags, deprecation status, source repository URL, star and fork counts, open issue count, version count, publication timestamp, and the timestamp when the check was run.","failureModes":["Unknown package name returns empty or 404-style response","Invalid system value (anything other than npm/pypi/go/maven/cargo/nuget) returns an error","Maven packages require group:artifact format; omitting the group causes lookup failure","Rate limiting or payment failure returns 402 or 429 error","Package exists but has no scorecard data — scorecard fields return null","Network timeout for packages with very large version histories"],"whenToPreferThis":"Choose this endpoint when you need a one-call consolidated risk snapshot for an open-source package — combining advisories, license, scorecard, and release freshness — without having to aggregate multiple registries or APIs yourself. Ideal for CI/CD gates, agent-driven dependency audits, or compliance checks across all major package ecosystems (npm, PyPI, Go, Maven, Cargo, NuGet).","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T13:05:37.642Z","isFirstParty":false,"canonicalSlug":"saylor-innovations-data-desk-package-dependency-risk-d4a7dea2"}