# Datakoot Package Vulnerabilities

> Datakoot Package Vulnerabilities is a paid API for AI agents from x402.datakoot.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-10).

Looks up known security vulnerabilities for a specific package version across major ecosystems (npm, PyPI, Cargo, etc.) using OSV.dev data.

## Facts

- Endpoint: POST https://x402.datakoot.com/api/package_vulnerabilities?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/datakoot-package-vulnerabilities-87081a42
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jgFLugeoKgW_3w_wCKZan

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability datakoot-package-vulnerabilities-87081a42 -d '<json body>'
```

Example prompt: Can you check if lodash version 4.17.15 on npm has any known security vulnerabilities, and list any CVEs or GHSA IDs?

## When to prefer this

Choose this endpoint when you need fast, structured vulnerability data for a specific package by name, version, and ecosystem — especially when you want OSV.dev data without setting up your own integration. Prefer this over generic web search when you need machine-readable CVE/GHSA IDs, CVSS scores, and references in a single call. It is particularly useful for agents doing dependency auditing, CI security gates, or supply chain risk assessments at $0.002 per call with no rate-limit concerns.

## Known failure modes

- Package not found in the specified ecosystem — returns empty vulnerability list
- Invalid ecosystem string — may return error or no results
- Version string not matching any published release — falls back to all versions
- Network timeout or OSV.dev upstream unavailability — returns 5xx error
- Malformed request body missing required 'name' or 'ecosystem' fields — returns 4xx validation error

## How this service works

48 live public-data tools (security, packages, SEC filings, economy, FX, weather, domains, Federal Register, Base) for AI agents. $0.002 USDC per call on Base via x402, charged only on success. The same tools are free for 100 calls/day via MCP at <server>.datakoot.com/mcp.

## Output

Returns a JSON object with the package name, ecosystem, version queried, the data source (OSV.dev), a list of vulnerabilities each containing a GHSA ID, CVE aliases, a plain-English summary, CVSS severity string, publication date, and reference URLs, plus a total vulnerability count.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "description": "Exact package name as published in that registry, e.g. lodash for npm, requests for pypi."
  },
  "version": {
   "type": "string",
   "description": "Optional; if given, only vulns affecting that version are returned"
  },
  "ecosystem": {
   "type": "string",
   "description": "Package registry to look in. One of: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodash",
  "source": "OSV.dev (CC-BY 4.0)",
  "version": "4.17.15",
  "ecosystem": "npm",
  "vulnerabilities": [
   {
    "id": "GHSA-29mw-wpgm-hmr9",
    "aliases": [
     "CVE-2020-28500"
    ],
    "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
    "severity": [
     "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
    ],
    "published": "2022-01-06T20:30:46Z",
    "references": [
     "https://nvd.nist.gov/vuln/detail/CVE-2020-28500",
     "https://github.com/github/advisory-database/pull/6139"
    ]
   },
   {
    "id": "GHSA-35jh-r3h4-6jhm",
    "aliases": [
     "CVE-2021-23337",
     "CVE-2026-4800"
    ],
    "summary": "Command Injection in lodash",
    "severity": [
     "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
    ],
    "published": "2021-05-06T16:05:51Z",
    "references": [
     "https://nvd.nist.gov/vuln/detail/CVE-2021-23337",
     "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
    ]
   }
  ],
  "vulnerability_count": 6
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/datakoot-package-vulnerabilities-87081a42/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.datakoot.com](https://www.zero.xyz/host/x402.datakoot.com/llms.txt)