{"uid":"cap_q1BCvODgXsG-Fy3BG1VUY","slug":"annalist-package-watch-2c9cec4d","name":"Annalist Package Watch","description":"Supply-chain watch across the 8,000 most-used packages on each of npm, PyPI, crates.io and Go, newest first: releases by a new publisher account, maintainer and owner changes, install scripts added, provenance dropped, source repositories moved, retractions, deprecations and yanks, with counts, for the last 1 to 30 days (days=, default 7), for one ecosystem or all. Signed.","url":"https://api.annalist.dev/v1/packages/watch?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"days":{"type":"string","description":"1 to 30 (default 7)"},"ecosystem":{"enum":["npm","pypi","crates","go"],"type":"string"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_A5J-vhS6nPiQYBRM8gUKf","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Monitors the top 8,000 packages on npm, PyPI, crates.io, and Go for supply-chain risk events such as new publisher releases, maintainer changes, install scripts added, provenance dropped, and retractions over a configurable time window.","exampleAgentPrompt":"Pull the Annalist package watch feed for npm over the last 14 days and show me any packages that had maintainer changes, new publisher releases, or install scripts added.","exampleUseCases":[{"title":"Daily supply chain security briefing","prompt":"Give me today's supply chain risk summary across all ecosystems for the past 7 days — I want to know about any maintainer changes, new publisher accounts releasing packages, or provenance that got dropped."},{"title":"Targeted PyPI threat scan","prompt":"Scan PyPI for the last 30 days and flag any of the top packages that were released by a new publisher account or had their source repo moved — I'm worried about dependency confusion attacks."},{"title":"Go module retraction alert","prompt":"Check the Annalist watch feed for Go packages over the past 3 days and tell me which ones were retracted, yanked, or deprecated so I can review my go.mod for affected dependencies."}],"resultDescription":"A signed JSON response listing supply-chain risk events for the top 8,000 packages on the requested ecosystem(s), newest first. Each event includes the package name, event type (e.g. new publisher, maintainer change, install script added, provenance dropped, repo moved, retraction, deprecation, yank), and counts, scoped to the requested day window (1–30 days, default 7). Response is cryptographically signed for agent verification.","failureModes":["Invalid 'days' value outside 1–30 range returns an error","Invalid 'ecosystem' enum value returns a validation error","Payment failure via x402 protocol blocks the response","Upstream data lag may cause recent events (last few hours) to be missing","Rate limiting if many calls are made in rapid succession"],"whenToPreferThis":"Use this endpoint when you need a broad, curated watch over the most-used packages across one or all major ecosystems for supply-chain risk signals. Prefer it over manual package registry polling because it covers the top 8,000 packages per ecosystem, delivers signed data suitable for agent pipelines, and aggregates multiple risk event types (maintainer changes, provenance drops, install scripts, retractions) in one call. Ideal for security agents running daily or weekly briefings, CI/CD pipelines checking for new risks in dependencies, or any system that needs tamper-evident supply-chain intelligence.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T18:41:13.493Z","isFirstParty":false,"canonicalSlug":"annalist-package-watch-2c9cec4d"}