{"uid":"cap_pQWeZ5xGKBCiYKdrQaqc-","slug":"ambolt-package-vulnerability-scanner-963d761e","name":"Ambolt Package Vulnerability Scanner","description":"Pay-per-call data tools for developers and AI agents: company registers, documents, tenders, rates and on-chain facts as MCP tools, x402 endpoints and Apify Actors.","url":"https://api.ambolt.dev/v1/package-vulnerabilities?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"const":"http"},"method":{"enum":["GET","POST"]},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","pattern":"^[@A-Za-z0-9._/-]+$","maxLength":214,"description":"Package name, e.g. lodash or requests."},"version":{"type":"string","pattern":"^[A-Za-z0-9._+-]+$","maxLength":64,"description":"Version to check. Default: latest published version."},"ecosystem":{"enum":["npm","PyPI"],"type":"string","description":"Package ecosystem."}},"additionalProperties":false}}}}},"responseSchema":{"type":"json","example":{"name":"lodash","source":"Source: OSV.dev (CC BY 4.0 for most data) and the package registry. Not a complete audit: unreported issues are not listed.","isLatest":false,"checkedAt":"2026-10-02T21:35:48.558Z","ecosystem":"npm","deprecated":null,"latestVersion":"4.18.1","checkedVersion":"4.17.20","vulnerabilities":[{"id":"GHSA-29mw-wpgm-hmr9","url":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":"MODERATE","published":"2022-01-06T20:30:46Z","firstFixedVersion":"4.17.21"},{"id":"GHSA-35jh-r3h4-6jhm","url":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-r5fr-rjxr-66jc"],"summary":"Command Injection in lodash","severity":"HIGH","published":"2021-05-06T16:05:51Z","firstFixedVersion":"4.17.21"},{"id":"GHSA-f23m-r3pf-42rh","url":"https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-xxjr-mmjv-4gpg"],"summary":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","severity":"MODERATE","published":"2026-04-01T23:50:27Z","firstFixedVersion":"4.18.0"}],"vulnerabilityCount":5}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_emaXcPGMnSW_eF3537rMG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an npm or PyPI package for known security vulnerabilities, deprecation status, and latest version info sourced from OSV.dev","exampleAgentPrompt":"Check if lodash version 4.17.20 on npm has any known security vulnerabilities and tell me what severity they are and which version fixes them.","exampleUseCases":[{"title":"Pre-install dependency security check","prompt":"Before I add requests version 2.28.0 from PyPI to my project, can you check if it has any known vulnerabilities and whether there's a safer version I should use instead?"},{"title":"CI pipeline vulnerability gate","prompt":"Scan the npm package express at version 4.18.1 for any known CVEs or high-severity security issues — I need to decide if it's safe to ship."},{"title":"Audit legacy codebase packages","prompt":"We're still running lodash 4.17.19 in production — can you pull up all known vulnerabilities for that npm package and tell me the minimum version I'd need to upgrade to in order to fix them?"}],"resultDescription":"Returns a JSON object containing the checked package name, ecosystem, checked version, latest published version, whether the checked version is the latest, a deprecation notice if applicable, a list of vulnerabilities (each with GHSA/CVE IDs, summary, severity, published date, and first fixed version), a total vulnerability count, the data source attribution, and the timestamp of the check.","failureModes":["Invalid package name format — returns error if name doesn't match allowed pattern","Package not found in the specified ecosystem — may return empty results or error","Version string doesn't exist — endpoint may fall back to latest or return an error","Unsupported ecosystem value — only 'npm' and 'PyPI' are accepted","Transient OSV.dev upstream unavailability — may cause delayed or failed responses","Payment failure (x402) — call not executed if USDC payment not settled"],"whenToPreferThis":"Choose this endpoint when you need a quick, pay-per-call programmatic vulnerability check for a specific npm or PyPI package without setting up a full security scanning pipeline. It's ideal for AI agents doing pre-install checks, CI gatekeeping, or auditing individual dependencies on demand. Prefer it over running local tools (e.g. npm audit) when operating in a serverless or agent context without local package install access. The OSV.dev data source covers a broad range of CVEs and GitHub Security Advisories.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:37:02.452Z","isFirstParty":false,"canonicalSlug":"ambolt-package-vulnerability-scanner-963d761e"}