{"uid":"cap_zx5zfuiIrKhryqmJCzdri","slug":"vextorium-package-vulnerability-scanner-6dfaf0e0","name":"Vextorium Package Vulnerability Scanner","description":"Known vulnerabilities of a software package (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist...) at a given version or overall: CVE/GHSA ids, summary, severity, publication date and fixed versions. Google's OSV.dev database.","url":"https://api.vextorium.com/v1/package-vulnerabilities?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"required":["package","ecosystem"],"properties":{"package":{"type":"string"},"version":{"type":"string"},"ecosystem":{"type":"string","description":"npm, pypi, cargo, go, maven, nuget, rubygems, packagist, hex, pub"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":["object","null"],"properties":{"detail":{"type":["array","null"],"items":{"type":["null","object"],"properties":{"id":{"type":["null","string"]},"alias":{"type":["array","null"],"items":{"type":["null","string"]}},"summary":{"type":["null","string"]},"severity":{"type":["null","string"]},"published":{"type":["null","string"]},"corrected_in":{"type":["array","null"],"items":{"type":["null","string"]}}}}},"source":{"type":["string","null"]},"package":{"type":["string","null"]},"verdict":{"type":["string","null"]},"version":{"type":["string","null"]},"ecosystem":{"type":["string","null"]},"vulnerabilities":{"type":["number","null"]}}}}}}},"responseSchema":{"type":"json","example":{"detail":[{"id":"GHSA-35jh-r3h4-6jhm","alias":["CVE-2021-23337","CVE-2026-4800"],"summary":"Command Injection in lodash","severity":"HIGH","published":"2021-05-06","corrected_in":["4.17.21"]},{"id":"GHSA-p6mc-m468-83gw","alias":["CVE-2020-8203"],"summary":"Prototype Pollution in lodash","severity":"HIGH","published":"2020-07-15","corrected_in":["4.17.19","4.17.20"]}],"source":"OSV.dev (CC BY 4.0)","package":"lodash","verdict":"6 known vulnerabilities: upgrade to a fixed version","version":"4.17.15","ecosystem":"npm","vulnerabilities":6}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_3eQnxaexQ0-q6bR0EHCLN","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a software package for known security vulnerabilities across major ecosystems (npm, PyPI, Cargo, Go, Maven, NuGet, etc.) and returns CVE/GHSA details with severity and fix versions.","exampleAgentPrompt":"Check if lodash version 4.17.15 on npm has any known security vulnerabilities and tell me how severe they are and which version fixes them.","exampleUseCases":[{"title":"Auditing a JavaScript dependency","prompt":"I'm about to ship a new release — can you check if lodash 4.17.15 in npm has any known CVEs or security advisories, and tell me what version I should upgrade to?"},{"title":"Checking a Python package before install","prompt":"Before I add requests 2.25.0 from PyPI to my project, can you scan it for known vulnerabilities and let me know if it's safe to use?"},{"title":"CI pipeline security gate","prompt":"We're running a build pipeline and need to verify that com.fasterxml.jackson.core:jackson-databind version 2.12.0 from Maven doesn't have any HIGH or CRITICAL severity vulnerabilities — can you check that for me?"}],"resultDescription":"Returns a JSON object with: the package name, version, and ecosystem; total count of known vulnerabilities; a human-readable verdict; the data source (OSV.dev); and a detailed list of individual vulnerability records each containing a GHSA/CVE ID, aliases, summary description, severity level, publication date, and the versions in which the issue was corrected.","failureModes":["Package not found in the specified ecosystem — returns empty or null detail array","Invalid ecosystem value — request validation error","Missing required fields (package or ecosystem) — validation error","Package exists but has no recorded vulnerabilities — returns 0 vulnerabilities and clean verdict","Version not specified — may return aggregate vulnerabilities across all versions","Network or upstream OSV.dev timeout — service error response"],"whenToPreferThis":"Use this endpoint when you need to programmatically check a specific open-source package for known CVEs and security advisories across a wide range of ecosystems (npm, PyPI, Go, Cargo, Maven, NuGet, RubyGems, etc.) and want structured output including severity, fix versions, and GHSA/CVE IDs. It is backed by OSV.dev, the authoritative open-source vulnerability database. Prefer this over manual advisory searches when integrating security checks into an AI agent workflow, CI/CD audit, or dependency review process.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:43:20.128Z","isFirstParty":false,"canonicalSlug":"vextorium-package-vulnerability-scanner-6dfaf0e0"}