{"uid":"cap_mjswo3fIFDWnhukKzXz7c","slug":"package-cve-lookup-b8dfcdf9","name":"Package CVE Lookup","description":"Look up known vulnerabilities (CVE/GHSA) for an open-source package version via OSV.dev. Supports npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist. Returns ids, severity and fixed versions.","url":"https://164.160.90.241.sslip.io/api/sec-container-cve-scanner?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["package"],"properties":{"package":{"type":"string","description":"Package name"},"version":{"type":"string","description":"Exact version (omit for all)"},"ecosystem":{"type":"string","description":"npm | pypi | go | maven | cargo | nuget | rubygems | packagist"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Worw7GSsRyLrSVDyMOGZ8","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.1","costPer":"request","priority":0,"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Look up known CVE/GHSA vulnerabilities for a specific open-source package version across major ecosystems via OSV.dev, returning vulnerability IDs, severity, and fixed versions.","exampleAgentPrompt":"Can you check if lodash version 4.17.15 on npm has any known CVEs or security vulnerabilities, and tell me what version I should upgrade to if there are fixes available?","exampleUseCases":[{"title":"Auditing a Python dependency before deploy","prompt":"Before I push this release, can you check if requests version 2.27.1 on PyPI has any known CVEs and whether there's a patched version I should use instead?"},{"title":"Scanning a Node.js package for exploits","prompt":"I'm using express 4.17.1 in my npm project — are there any GHSA or CVE advisories against that exact version, and how severe are they?"},{"title":"Checking a Rust crate for vulnerabilities","prompt":"Does the serde_json crate version 1.0.85 on crates.io have any known security vulnerabilities I should be worried about?"}],"resultDescription":"Returns a list of known vulnerabilities for the queried package/version, including vulnerability IDs (CVE or GHSA), severity ratings (e.g. CRITICAL, HIGH, MEDIUM, LOW), affected version ranges, and the fixed versions that resolve each issue. If no vulnerabilities are found, returns an empty list.","failureModes":["Unknown or misspelled package name returns empty results or error","Unsupported ecosystem value causes a bad request error","Missing required 'package' query parameter returns a 400-level error","Upstream OSV.dev API unavailability causes a 502 or timeout","Very new or obscure packages may have no indexed vulnerabilities even if they exist"],"whenToPreferThis":"Choose this endpoint when you need a fast, per-package CVE/GHSA lookup against OSV.dev without setting up your own toolchain. It covers all major ecosystems (npm, PyPI, Go, Maven, cargo, NuGet, RubyGems, Packagist) in one call and returns structured severity and fix-version data, making it ideal for dependency auditing in CI/CD pipelines, chatbot security checks, or agent-driven software reviews. Prefer it over full SCA (Software Composition Analysis) tools when you only need advisory data for a specific package version rather than scanning an entire project lockfile.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:35:59.381Z","isFirstParty":false,"canonicalSlug":"package-cve-lookup-b8dfcdf9"}