# Dependency Risk Single Package Vulnerability Check

> Dependency Risk Single Package Vulnerability Check is a paid API for AI agents from dependency-risk.use.x402atlas.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Checks one open-source package version or purl against OSV, enriches CVE matches with CISA KEV known-exploited signals, and returns fix recommendations, severity scores, and provenance.

## Facts

- Endpoint: POST https://dependency-risk.use.x402atlas.com/package
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dependency-risk-single-package-vulnerability-check-f74ec38e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-9SFeBVm4BreM7ZZP3dnI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dependency-risk-single-package-vulnerability-check-f74ec38e -d '<json body>'
```

Example prompt: Can you check whether lodash version 4.17.20 on npm has any known vulnerabilities, including whether any CVEs are in the CISA KEV known-exploited list, and tell me what version I should upgrade to?

## When to prefer this

Use this endpoint when you need to check a single, precisely identified package version (by name+version or purl) for vulnerabilities with CISA KEV enrichment — ideal for per-dependency CI gates, PR checks, or on-demand advisory lookups. Choose the batch sibling endpoint when scanning multiple dependencies at once, and the SBOM sibling for full CycloneDX bill-of-materials analysis.

## Known failure modes

- Unknown or misspelled package name returns no matches rather than an error
- Unsupported ecosystem or malformed purl returns a validation error
- Package version not found in OSV returns empty vulnerability list (not necessarily safe)
- Network timeout to OSV or CISA KEV upstream returns a service error
- Very new CVEs not yet indexed in OSV may be missed

## How this service works

Package vulnerability check — check one exact open-source dependency version or purl against OSV, enrich CVE matches with CISA KEV known-exploited signals, and report fixes, severity, and provenance.

## Output

Returns a structured report for the queried package version including: matched OSV advisory IDs, CVE identifiers, CVSS severity scores, whether each CVE appears in the CISA KEV known-exploited catalog, recommended fix/patched versions, and provenance metadata about each vulnerability finding.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dependency-risk-single-package-vulnerability-check-f74ec38e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dependency-risk.use.x402atlas.com](https://www.zero.xyz/host/dependency-risk.use.x402atlas.com/llms.txt)