# Annalist Package Supply-Chain Check

> Annalist Package Supply-Chain Check is a paid API for AI agents from api.annalist.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Returns a supply-chain security profile for a single npm, PyPI, crates.io, or Go package: version, maintainers, install scripts, provenance, deprecation, and recent anomalous changes.

## Facts

- Endpoint: GET https://api.annalist.dev/v1/packages/check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/annalist-package-supply-chain-check-33242695
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_GiGwKpQtYyUbiDRuxfTUT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability annalist-package-supply-chain-check-33242695
```

Example prompt: Can you do a supply-chain check on the lodash npm package — I want to know if there have been any owner changes, new publisher accounts, install script additions, or provenance issues since you started tracking it?

## When to prefer this

Use this endpoint when you need a fast, structured, signed supply-chain audit of a single popular package before installing or shipping it, especially when you care about owner changes, new publisher accounts, install scripts, or provenance integrity. Prefer this over general package registry APIs when you want anomaly detection and historical change tracking rather than just package metadata. Best for automated CI/CD security gates or agent-driven dependency review flows.

## Known failure modes

- Package not found in the specified ecosystem — returns error if the package name is not in the tracked top-8,000 list
- Missing required 'name' query parameter — returns validation error
- Invalid ecosystem value — only npm, pypi, crates, go are accepted
- Payment failure — x402 payment of 0.01 USDC required per call; unpaid requests are rejected
- Network or upstream data unavailability — may return stale or partial data

## How this service works

Supply-chain check of a popular package (the 8,000 most used on each of npm, PyPI, crates.io and Go): latest version and release activity, maintainers or owners, install scripts, provenance, deprecation, retractions, and what changed since we began tracking it daily: releases by a new publisher account, owner changes, install scripts added, provenance dropped, source repository moved, yanks. Account names are never published. Signed.

## Output

A signed JSON response containing: latest version and release activity, current maintainers/owners, presence of install scripts, provenance status, deprecation and retraction flags, and a changelog of anomalous events detected since daily tracking began — including releases by new publisher accounts, owner changes, install scripts added, provenance dropped, source repository moves, and yanks. Account names are omitted from the response.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "package name, for example lodash, requests, serde or golang.org/x/crypto"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "crates",
        "go"
       ],
       "type": "string",
       "description": "npm (default), pypi, crates or go"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/annalist-package-supply-chain-check-33242695/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.annalist.dev](https://www.zero.xyz/host/api.annalist.dev/llms.txt)