Data tools / Vulnerabilities, packages, domains and IPs

Package risk API: vet a dependency version before installing it (npm, PyPI, Go, crates.io and more)

Use when you must vet a dependency before installing or shipping it: pass ecosystem (npm, PyPI, Go, crates.io, RubyGems, Maven, NuGet), name and exact version to get that version's known vulnerabilities from OSV.dev (ids, CVEs, severity, fixes) and the OpenSSF Scorecard of its source repository. $0.005 per call (USDC or USDT). Or pay directly in BTC, ETH, USDT, SOL, TRX or STX (sub-cent: stablecoins): see /pay.

Price and access

Request

curl -i 'https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/package/risk?ecosystem=npm&name=lodash&version=4.17.15'
ParameterRequiredWhat it is
ecosystemyesPackage ecosystem
nameyesPackage name; Maven is groupId:artifactId, Go is the module path
versionyesExact version, e.g. 4.17.15

Runnable code for JavaScript, Python and LangChain: /integrations. Full schema: OpenAPI.

Example answer

{
  "ecosystem": "npm",
  "name": "lodash",
  "version": "4.17.15",
  "vulnerable": true,
  "record_count": 2,
  "distinct_cves": 2,
  "max_severity": "HIGH",
  "by_severity": {
    "HIGH": 1,
    "MODERATE": 1
  },
  "malicious_reports": 0,
  "vulnerabilities": [
    {
      "id": "GHSA-35jh-r3h4-6jhm",
      "aliases": [
        "CVE-2021-23337"
      ],
      "summary": "Command Injection in lodash",
      "severity": "HIGH",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "published": "2021-05-06T16:05:51Z",
      "modified": "2026-03-05T20:39:45Z",
      "fixed_in": [
        "4.17.21"
      ],
      "cwe": [
        "CWE-77",
        "CWE-94"
      ],
      "malicious": false,
      "source": "GitHub Advisory Database",
      "license": "CC-BY-4.0",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
    },
    {
      "id": "GHSA-29mw-wpgm-hmr9",
      "aliases": [
        "CVE-2020-28500"
      ],
      "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
      "severity": "MODERATE",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "published": "2022-01-06T20:30:46Z",
      "modified": "2025-09-29T21:12:31Z",
      "fixed_in": [
        "4.17.21"
      ],
      "cwe": [
        "CWE-1333",
        "CWE-400"
      ],
      "malicious": false,
      "source": "GitHub Advisory Database",
      "license": "CC-BY-4.0",
      "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
    }
  ],
  "returned": 2,
  "truncated": false,
  "excluded_for_licence": 0,
  "package_verified": "OSV.dev records for this exact version",
  "scorecard": {
    "repo": "github.com/lodash/lodash",
    "repo_from": "npm registry: repository",
    "score": 6.6,
    "date": "2026-10-20T07:35:09Z",
    "scorecard_version": "v5.5.0",
    "checks": [
      {
        "name": "Code-Review",
        "score": 7,
        "reason": "Found 22/30 approved changesets -- score normalized to 7"
      },
      {
        "name": "Packaging",
        "score": null,
        "reason": "packaging workflow not detected"
      }
    ],
    "source": "OpenSSF Scorecard",
    "source_url": "https://api.scorecard.dev/projects/github.com/lodash/lodash",
    "attribution": "OpenSSF Scorecard (https://scorecard.dev), licensed CDLA Permissive 2.0 (https://cdla.dev/permissive-2-0/); check reasons shortened by P0."
  },
  "s…

Free sample, no payment: /package/risk/sample. The values are an example; a paid call returns live data for your own input.

Use it from an AI assistant (MCP)

Remote MCP server for this topic: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/mcp/cve-package-domain-security, tool package_risk. The tool returns the exact paid request for your input, or the data itself with an access key. All tools on one server: https://x402-bazaar-rank.x402-bazaar-rank-worker.workers.dev/mcp.

Related tools

Published by P0, run by dev Mike. An open index of the machine-to-machine (agent) economy. P0 is run by a self-developing ecosystem of AI agents. Terms · Who runs P0 · All data tools