# Package CVE Lookup

> Package CVE Lookup is a paid API for AI agents from 164.160.90.241.sslip.io, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-10).

Look up known CVE/GHSA vulnerabilities for a specific open-source package version across major ecosystems via OSV.dev, returning vulnerability IDs, severity, and fixed versions.

## Facts

- Endpoint: GET https://164.160.90.241.sslip.io/api/sec-container-cve-scanner?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-cve-lookup-b8dfcdf9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_mjswo3fIFDWnhukKzXz7c

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-cve-lookup-b8dfcdf9
```

Example prompt: Can you check if lodash version 4.17.15 on npm has any known CVEs or security vulnerabilities, and tell me what version I should upgrade to if there are fixes available?

## When to prefer this

Choose this endpoint when you need a fast, per-package CVE/GHSA lookup against OSV.dev without setting up your own toolchain. It covers all major ecosystems (npm, PyPI, Go, Maven, cargo, NuGet, RubyGems, Packagist) in one call and returns structured severity and fix-version data, making it ideal for dependency auditing in CI/CD pipelines, chatbot security checks, or agent-driven software reviews. Prefer it over full SCA (Software Composition Analysis) tools when you only need advisory data for a specific package version rather than scanning an entire project lockfile.

## Known failure modes

- Unknown or misspelled package name returns empty results or error
- Unsupported ecosystem value causes a bad request error
- Missing required 'package' query parameter returns a 400-level error
- Upstream OSV.dev API unavailability causes a 502 or timeout
- Very new or obscure packages may have no indexed vulnerabilities even if they exist

## How this service works

Look up known vulnerabilities (CVE/GHSA) for an open-source package version via OSV.dev. Supports npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist. Returns ids, severity and fixed versions.

## Output

Returns a list of known vulnerabilities for the queried package/version, including vulnerability IDs (CVE or GHSA), severity ratings (e.g. CRITICAL, HIGH, MEDIUM, LOW), affected version ranges, and the fixed versions that resolve each issue. If no vulnerabilities are found, returns an empty list.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "package"
     ],
     "properties": {
      "package": {
       "type": "string",
       "description": "Package name"
      },
      "version": {
       "type": "string",
       "description": "Exact version (omit for all)"
      },
      "ecosystem": {
       "type": "string",
       "description": "npm | pypi | go | maven | cargo | nuget | rubygems | packagist"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-cve-lookup-b8dfcdf9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 164.160.90.241.sslip.io](https://www.zero.xyz/host/164.160.90.241.sslip.io/llms.txt)