{"uid":"cap_jgFLugeoKgW_3w_wCKZan","slug":"datakoot-package-vulnerabilities-87081a42","name":"Datakoot Package Vulnerabilities","description":"48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.","url":"https://x402.datakoot.com/api/package_vulnerabilities?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"name":{"type":"string","description":"Exact package name as published in that registry, e.g. lodash for npm, requests for pypi."},"version":{"type":"string","description":"Optional; if given, only vulns affecting that version are returned"},"ecosystem":{"type":"string","description":"Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex."}}},"responseSchema":{"type":"json","example":{"name":"lodash","source":"OSV.dev (CC-BY 4.0)","version":"4.17.15","ecosystem":"npm","vulnerabilities":[{"id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":["CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"],"published":"2022-01-06T20:30:46Z","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/github/advisory-database/pull/6139"]},{"id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800"],"summary":"Command Injection in lodash","severity":["CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"],"published":"2021-05-06T16:05:51Z","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"]}],"vulnerability_count":6}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HKfvkUfvTR-BLor89Lxd6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up known security vulnerabilities for a specific package version across major ecosystems (npm, PyPI, Cargo, etc.) using OSV.dev data.","exampleAgentPrompt":"Can you check if lodash version 4.17.15 on npm has any known security vulnerabilities, and list any CVEs or GHSA IDs?","exampleUseCases":[{"title":"Audit dependency before shipping","prompt":"Before I release my app, check if the requests 2.25.1 PyPI package has any known CVEs or security advisories I should know about."},{"title":"CI pipeline vulnerability gate","prompt":"My build is using log4j 2.14.1 from Maven — does it have any critical vulnerabilities listed in OSV? I need the severity scores too."},{"title":"Supply chain risk review","prompt":"We're evaluating adding the axios npm package at version 0.21.1 to our project — pull up any known vulnerabilities for it so I can decide if it's safe."}],"resultDescription":"Returns a JSON object with the package name, ecosystem, version queried, the data source (OSV.dev), a list of vulnerabilities each containing a GHSA ID, CVE aliases, a plain-English summary, CVSS severity string, publication date, and reference URLs, plus a total vulnerability count.","failureModes":["Package not found in the specified ecosystem — returns empty vulnerability list","Invalid ecosystem string — may return error or no results","Version string not matching any published release — falls back to all versions","Network timeout or OSV.dev upstream unavailability — returns 5xx error","Malformed request body missing required 'name' or 'ecosystem' fields — returns 4xx validation error"],"whenToPreferThis":"Choose this endpoint when you need fast, structured vulnerability data for a specific package by name, version, and ecosystem — especially when you want OSV.dev data without setting up your own integration. Prefer this over generic web search when you need machine-readable CVE/GHSA IDs, CVSS scores, and references in a single call. It is particularly useful for agents doing dependency auditing, CI security gates, or supply chain risk assessments at $0.002 per call with no rate-limit concerns.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:36:54.361Z","isFirstParty":false,"canonicalSlug":"datakoot-package-vulnerabilities-87081a42"}