# DepVet Package Risk Report

> DepVet Package Risk Report is a paid API for AI agents from depvet.imac2014ville.workers.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-12).

Checks an npm or PyPI package for vulnerabilities, malware, license risk, deprecation, maintenance health, and typosquatting, returning an OK/REVIEW/AVOID verdict.

## Facts

- Endpoint: GET https://depvet.imac2014ville.workers.dev/report?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/depvet-package-risk-report-095a5a8a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ssmjyGl00ubmjsyHRPNy-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability depvet-package-risk-report-095a5a8a
```

Example prompt: Before I add it to my project, can you check whether the npm package 'lodash' version 4.17.20 is safe to install — I need to know about any vulnerabilities, license issues, or typosquatting risks?

## When to prefer this

Use DepVet when an AI agent needs a fast, single-call security verdict on a specific npm or PyPI package before installation or dependency pinning. It is especially valuable in automated CI/CD pipelines, agent-driven dependency resolution, or when a user asks whether a package is safe. Prefer this over manual OSV lookups or separate scorecard queries because it aggregates vulnerabilities, malware advisories, license risk, typosquat detection, and maintenance signals into one structured verdict with no API key required — just a $0.02 USDC x402 micropayment per call.

## Known failure modes

- Package not found in the specified ecosystem — returns an error response
- Invalid ecosystem value (only 'npm' and 'pypi' are accepted) — returns a validation error
- Version string does not exist for the package — may fall back to latest or return not found
- OSV or OpenSSF upstream data temporarily unavailable — may return partial results
- Payment not completed (x402) — request blocked before processing
- Rate limiting or quota exceeded on upstream data sources

## How this service works

NPM supply chain attack and malicious package check for npm and PyPI: typosquat detection, dependency vulnerability scan (CVE/OSV), license check, OpenSSF Scorecard. OK/REVIEW/AVOID verdict before you install. No API key: pay USDC on Base per call via x402.

## Output

Returns a JSON object with a top-level verdict of OK, REVIEW, or AVOID; a list of reasons with codes and messages explaining the verdict; vulnerability count and max severity; license SPDX identifier and risk class; a typosquatting suspicion flag; direct and transitive dependency counts; and the resolved package version and ecosystem.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name, e.g. express, @types/node, requests"
      },
      "version": {
       "type": "string",
       "description": "Exact version (default: latest)"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "name": "lodash",
  "license": {
   "spdx": "MIT",
   "riskClass": "permissive"
  },
  "reasons": [
   {
    "code": "high-vuln",
    "level": "REVIEW",
    "message": "3 high-severity vulnerability advisory(ies) affect this version."
   }
  ],
  "verdict": "REVIEW",
  "version": "4.17.20",
  "ecosystem": "npm",
  "typosquat": {
   "suspect": false
  },
  "dependencies": {
   "direct": 0,
   "transitive": 0
  },
  "vulnerabilities": {
   "count": 4,
   "maxSeverity": "HIGH"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/depvet-package-risk-report-095a5a8a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from depvet.imac2014ville.workers.dev](https://www.zero.xyz/host/depvet.imac2014ville.workers.dev/llms.txt)