{"uid":"cap_ssmjyGl00ubmjsyHRPNy-","slug":"depvet-package-risk-report-095a5a8a","name":"DepVet Package Risk Report","description":"NPM supply chain attack and malicious package check for npm and PyPI: typosquat detection, dependency vulnerability scan (CVE/OSV), license check, OpenSSF Scorecard. OK/REVIEW/AVOID verdict before you install. No API key: pay USDC on Base per call via x402.","url":"https://depvet.imac2014ville.workers.dev/report?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Package name, e.g. express, @types/node, requests"},"version":{"type":"string","description":"Exact version (default: latest)"},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"Package ecosystem"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ok":true,"name":"lodash","license":{"spdx":"MIT","riskClass":"permissive"},"reasons":[{"code":"high-vuln","level":"REVIEW","message":"3 high-severity vulnerability advisory(ies) affect this version."}],"verdict":"REVIEW","version":"4.17.20","ecosystem":"npm","typosquat":{"suspect":false},"dependencies":{"direct":0,"transitive":0},"vulnerabilities":{"count":4,"maxSeverity":"HIGH"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_XEqjcBzockS4Tc1YXaZvh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks an npm or PyPI package for vulnerabilities, malware, license risk, deprecation, maintenance health, and typosquatting, returning an OK/REVIEW/AVOID verdict.","exampleAgentPrompt":"Before I add it to my project, can you check whether the npm package 'lodash' version 4.17.20 is safe to install — I need to know about any vulnerabilities, license issues, or typosquatting risks?","exampleUseCases":[{"title":"Pre-install security gate for npm package","prompt":"I'm about to add 'axios' to my Node project — can you check if it has any known vulnerabilities or license problems before I install it?"},{"title":"PyPI dependency audit for ML pipeline","prompt":"Before I pin 'requests' version 2.28.0 in my Python requirements.txt, run a security and maintenance check on it — I need to know the verdict and any high-severity issues."},{"title":"Typosquat detection before installing","prompt":"Someone on Slack told me to install a PyPI package called 'requets' — can you check if that looks like a typosquat or has any malware advisories flagged against it?"}],"resultDescription":"Returns a JSON object with a top-level verdict of OK, REVIEW, or AVOID; a list of reasons with codes and messages explaining the verdict; vulnerability count and max severity; license SPDX identifier and risk class; a typosquatting suspicion flag; direct and transitive dependency counts; and the resolved package version and ecosystem.","failureModes":["Package not found in the specified ecosystem — returns an error response","Invalid ecosystem value (only 'npm' and 'pypi' are accepted) — returns a validation error","Version string does not exist for the package — may fall back to latest or return not found","OSV or OpenSSF upstream data temporarily unavailable — may return partial results","Payment not completed (x402) — request blocked before processing","Rate limiting or quota exceeded on upstream data sources"],"whenToPreferThis":"Use DepVet when an AI agent needs a fast, single-call security verdict on a specific npm or PyPI package before installation or dependency pinning. It is especially valuable in automated CI/CD pipelines, agent-driven dependency resolution, or when a user asks whether a package is safe. Prefer this over manual OSV lookups or separate scorecard queries because it aggregates vulnerabilities, malware advisories, license risk, typosquat detection, and maintenance signals into one structured verdict with no API key required — just a $0.02 USDC x402 micropayment per call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:38:26.221Z","isFirstParty":false,"canonicalSlug":"depvet-package-risk-report-095a5a8a"}