Ops Control HQ npm Dependency Risk Brief

Choose this endpoint when you need both npm package health signals and exact-version OSV vulnerability data in a single call, rather than querying the npm registry and OSV separately. Ideal for CI/CD pipelines, dependency auditing tools, or security dashboards where you know the exact installed version and need actionable upgrade guidance with minimal API round-trips.

• Package name not found on npm registry — returns error or empty result
• Exact version does not exist for the specified package — may return no vulnerability match
• OSV database has no records for the package — returns clean/empty vulnerability list
• Malformed package name or version string — returns validation error
• Payment not completed or x402 auth failure — returns 402 Payment Required
• Rate limit or Supabase function timeout — returns 5xx error