{"sample":true,"route":"/package/risk","method":"GET","priceUsd":0.005,"request":"https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/package/risk?ecosystem=npm&name=lodash&version=4.17.15","response":{"ecosystem":"npm","name":"lodash","version":"4.17.15","vulnerable":true,"record_count":2,"distinct_cves":2,"max_severity":"HIGH","by_severity":{"HIGH":1,"MODERATE":1},"malicious_reports":0,"vulnerabilities":[{"id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337"],"summary":"Command Injection in lodash","severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","published":"2021-05-06T16:05:51Z","modified":"2026-03-05T20:39:45Z","fixed_in":["4.17.21"],"cwe":["CWE-77","CWE-94"],"malicious":false,"source":"GitHub Advisory Database","license":"CC-BY-4.0","url":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"},{"id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":"MODERATE","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","published":"2022-01-06T20:30:46Z","modified":"2025-09-29T21:12:31Z","fixed_in":["4.17.21"],"cwe":["CWE-1333","CWE-400"],"malicious":false,"source":"GitHub Advisory Database","license":"CC-BY-4.0","url":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"}],"returned":2,"truncated":false,"excluded_for_licence":0,"package_verified":"OSV.dev records for this exact version","scorecard":{"repo":"github.com/lodash/lodash","repo_from":"npm registry: repository","score":6.6,"date":"2026-10-20T07:35:09Z","scorecard_version":"v5.5.0","checks":[{"name":"Code-Review","score":7,"reason":"Found 22/30 approved changesets -- score normalized to 7"},{"name":"Packaging","score":null,"reason":"packaging workflow not detected"}],"source":"OpenSSF Scorecard","source_url":"https://api.scorecard.dev/projects/github.com/lodash/lodash","attribution":"OpenSSF Scorecard (https://scorecard.dev), licensed CDLA Permissive 2.0 (https://cdla.dev/permissive-2-0/); check reasons shortened by P0."},"scorecard_reason":null,"as_of":"2026-10-25T09:00:00.000Z","source":"OSV.dev","source_url":"https://osv.dev/list?ecosystem=npm&q=lodash","attribution":"Vulnerability records from OSV.dev (https://osv.dev), aggregated from the GitHub Advisory Database (CC-BY 4.0), PyPI Advisory Database (CC-BY 4.0), Go Vulnerability Database (CC-BY 4.0), RustSec (CC0 1.0), OSS-Fuzz (CC-BY 4.0), OpenSSF Malicious Packages (Apache 2.0), Global Security Database (CC0 1.0) and NVD (public domain). Each record names its source and licence; titles are shortened and reformatted by P0. Records under share-alike or non-commercial licences (Ubuntu, Alpine, Chainguard/Wolfi) and records of unverified origin are not included.","note":"Records OSV.dev holds for exactly this package version, as OSV matches them; different databases may describe the same issue (aliases) so record_count can exceed distinct_cves. severity is the source's own label (GitHub records only); no number is computed. No record is not proof of safety: OSV only lists disclosed issues. Package existence is confirmed by the records themselves or, when there are none, by the package registry (package_verified). scorecard: OpenSSF Scorecard of the whole source repo named by the registry entry, as of its scan date; null with scorecard_reason when none is named, covered or scanned."},"note":"Free sample: the answer shape and fields for the fixed example input in 'request'. Values are an example and may not be current data; a paid call returns live data for your own input.","buy":"Call https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/package/risk with an x402 or MPP client: the unpaid call answers HTTP 402 with the exact price; the paid call returns the data with a receipt. Other ways to pay: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/pay"}