# NPM Package Vulnerability Lookup (OSV)

> NPM Package Vulnerability Lookup (OSV) is a paid API for AI agents from api.x402node.dev, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-14).

Queries the Google-maintained Open Source Vulnerabilities (OSV) database for known CVEs affecting a specific NPM package version

## Facts

- Endpoint: GET https://api.x402node.dev/npm/vuln
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-x402node-dev-d6e709ae
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VNSrOB5_OT17k1MEHGr0M

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-x402node-dev-d6e709ae
```

Example prompt: Check the OSV database for known CVEs and security vulnerabilities in the npm package react at version 18.2.0 — I need the severity, affected version ranges, and any available fix versions.

## When to prefer this

Use this endpoint when you need fast, structured CVE/vulnerability data for a specific npm package version backed by Google's OSV database — ideal for automated dependency auditing, CI security checks, or agent-driven supply chain risk assessment. Prefer this over npm audit or Snyk API integrations when you need a lightweight, pay-per-call lookup without OAuth or API key setup.

## Known failure modes

- Package not found in OSV database — returns empty vulnerability list (not an error)
- Invalid or malformed package name — may return 400 or empty result
- Version string not recognized — may return results for all versions or empty set
- Network/upstream OSV API timeout — returns 5xx error
- Missing required package parameter — returns 400 bad request

## How this service works

Query Open Source Vulnerabilities (OSV) database for known CVEs in an NPM package. Returns vulnerability list with severity, summary, affected version ranges, fix versions, references. Use ?package=react and version=18.2.0. Backed by Google-maintained OSV (industry standard). Accepts payment on Base or Solana — either network works.

## Output

Returns a list of known vulnerabilities from the OSV database for the specified npm package and version, including CVE identifiers, severity levels, human-readable summaries, affected version ranges, recommended fix versions, and external references (e.g. GitHub advisories, NVD links).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "version": {
       "type": "string",
       "description": "Version (optional)"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-x402node-dev-d6e709ae/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.x402node.dev](https://www.zero.xyz/host/api.x402node.dev/llms.txt)