# Supply Chain Attack IOC Catalog – Active Campaign Listing

> Supply Chain Attack IOC Catalog – Active Campaign Listing is a paid API for AI agents from api.x402node.dev, paid per call via x402, $0.0022/call, status unknown (last checked 2026-09-14).

Returns a catalog of active supply chain attack indicators of compromise (IOCs) across npm, PyPI, and Composer package registries, including named campaigns like Shai-Hulud, TanStack, and Laravel-Lang.

## Facts

- Endpoint: GET https://api.x402node.dev/supply/ioc-list
- Price: $0.0022/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-x402node-dev-d7179ea1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_m0VUR2VywLZ7HXZablulC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-x402node-dev-d7179ea1
```

Example prompt: Before I install these npm and PyPI packages, can you pull the latest active supply chain attack IOC catalog and check if any of my dependencies match known malicious campaigns like Shai-Hulud or TanStack?

## When to prefer this

Use this endpoint when an AI coding agent needs to perform a pre-install security audit of package dependencies across npm, PyPI, or Composer, and wants to cross-reference against a curated list of known active supply chain attack campaigns. Prefer this over general vulnerability databases when you specifically need IOC-level campaign data for supply chain attacks rather than CVE-based vulnerability scoring.

## Known failure modes

- IOC data is in active verification state — matches may be incomplete or inaccurate (beta warning)
- Payment failure via x402 protocol results in 402 response and no data returned
- Unknown or unsupported registry filter returns empty result set
- Service unavailable returns 5xx with no IOC data
- Stale or unverified campaign entries may produce false positives

## How this service works

⚠️ BETA — IOC data under active verification 2026-05-25, do not rely on matches for production. Supply chain attack IOC catalog. List active campaigns: npm, PyPI, Composer. Shai-Hulud, TanStack, Laravel-Lang. For coding agents pre-install audit. Accepts payment on Base or Solana — either network works.

## Output

A structured list of active supply chain attack campaigns and their associated indicators of compromise (IOCs), scoped to package registries (npm, PyPI, Composer), including campaign names, affected package identifiers, and verification status. Note: data is under active verification and marked BETA as of 2026-05-25.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-x402node-dev-d7179ea1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.x402node.dev](https://www.zero.xyz/host/api.x402node.dev/llms.txt)