# AttestPage Package Security Checker

> AttestPage Package Security Checker is a paid API for AI agents from s2h6qt73jtzlgbgnnfacln2poq.srv.us, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-27).

Checks up to 10 npm, PyPI, or crates.io packages for registry status, version info, licence, and OSV.dev security advisories

## Facts

- Endpoint: POST https://s2h6qt73jtzlgbgnnfacln2poq.srv.us/v1/check/packages?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/attestpage-package-security-checker-b3dc2fd4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_SjaTgYSbxB_mmRfs0IT1p

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability attestpage-package-security-checker-b3dc2fd4 -d '<json body>'
```

Example prompt: Can you check whether the npm packages lodash@4.17.20 and axios, plus the PyPI package requests, have any known security advisories or licence issues?

## When to prefer this

Use this endpoint when you need a quick, multi-ecosystem, combined check of package existence, version, licence, and OSV.dev vulnerability data in a single call. Ideal for pre-install audits, CI pipeline checks, or licence compliance sweeps across npm, PyPI, and crates.io. It is cost-effective at $0.005 per call for up to 10 packages simultaneously, and returns signed, timestamped data suitable for audit trails.

## Known failure modes

- Package name not found in the specified ecosystem — returns unlisted status
- Unsupported ecosystem value (only npm, pypi, crates accepted)
- More than 10 packages submitted — request rejected
- Network or OSV.dev upstream timeout — advisory data may be incomplete
- Invalid version string format — advisory lookup may fall back to latest

## How this service works

Checks up to 10 npm, PyPI or crates names: listed, version, licence, OSV.dev advisories. US$0.005 per call; POST names.

## Output

For each queried package, the endpoint returns whether it is listed in the registry, its current or specified version, its licence, and any OSV.dev security advisories applicable to that version (or the latest version if none specified).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "packages": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "ecosystem",
     "name"
    ],
    "properties": {
     "name": {
      "type": "string",
      "description": "Package name as you would install it (npm names may be scoped: @scope/name)."
     },
     "version": {
      "type": "string",
      "maxLength": 64,
      "description": "Optional: the version you will install (e.g. a pinned 4.17.20). Advisories are then listed for this version; without it, for the latest."
     },
     "ecosystem": {
      "enum": [
       "npm",
       "pypi",
       "crates"
      ],
      "type": "string"
     }
    },
    "additionalProperties": false
   },
   "maxItems": 10,
   "minItems": 1,
   "description": "1 to 10 packages to look up. Each is { ecosystem, name, version? }; ecosystem is npm, pypi or crates (crates.io)."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/attestpage-package-security-checker-b3dc2fd4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from s2h6qt73jtzlgbgnnfacln2poq.srv.us](https://www.zero.xyz/host/s2h6qt73jtzlgbgnnfacln2poq.srv.us/llms.txt)