# Package Risk Check – npm & PyPI Supply-Chain Verdict

> Package Risk Check – npm & PyPI Supply-Chain Verdict is a paid API for AI agents from x402.botsmith.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-15).

Returns a transparent low/medium/high supply-chain risk verdict for an npm or PyPI package, covering known CVEs, age, install scripts, deprecation, download volume, and typosquatting distance.

## Facts

- Endpoint: GET https://x402.botsmith.dev/pkg-risk
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-risk-check-npm-pypi-supply-chain-verdict-aa063582
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_BgOwjlfpm-KjXpvLGACgL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-risk-check-npm-pypi-supply-chain-verdict-aa063582
```

Example prompt: Before I add it to the project, can you run a supply-chain risk check on the npm package 'lodash' version 4.17.21 and tell me the risk level with reasons?

## When to prefer this

Use this endpoint when you need a single-call, comprehensive supply-chain safety verdict on an npm or PyPI package before installing it — especially when you want CVE data, typosquat detection, install-script auditing, and age/popularity signals all bundled together rather than calling multiple separate APIs. Prefer it over generic vulnerability scanners when you need a transparent risk level with human-readable reasons and do not have your own OSV integration.

## Known failure modes

- Package not found in the specified ecosystem — returns an error indicating unknown package
- Invalid package name format — rejected by schema validation before the call is made
- Invalid version string — schema pattern mismatch
- Unsupported ecosystem value (anything other than npm or pypi) — enum validation failure
- Upstream registry or OSV API temporarily unavailable — may return a 5xx or timeout
- Payment not included or insufficient — x402 payment required response

## How this service works

Package Risk Check ($0.01/call): One-call supply-chain verdict before installing a package: known vulnerabilities (OSV), package and version age, install-time script hooks, deprecation, weekly downloads, typosquat distance to popular names, and a transparent low/medium/high risk level with reasons. Covers npm and PyPI, keyless upstreams.

## Output

A JSON object with ecosystem, package name, version checked, latest version, a structured risk object (level: low/medium/high, plus human-readable reasons), known vulnerabilities from OSV, package and version publish dates, deprecation status, install-time hook presence, weekly download count, typosquat distance to popular names, and maintainer count.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name",
      "ecosystem"
     ],
     "properties": {
      "name": {
       "type": "string",
       "pattern": "^(@[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}\\/)?[a-zA-Z0-9][a-zA-Z0-9._-]{0,212}$",
       "description": "Package name (npm supports @scope/name)"
      },
      "version": {
       "type": "string",
       "pattern": "^[0-9A-Za-z.+-]{1,64}$",
       "description": "Exact version to check; defaults to the latest release"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string",
       "default": "npm",
       "description": "Package registry (default npm)"
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "required": [
      "ecosystem",
      "name",
      "version",
      "latestVersion",
      "vulnerabilities",
      "package",
      "installScripts",
      "weeklyDownloads",
      "typosquat",
      "risk"
     ],
     "properties": {
      "name": {
       "type": "string"
      },
      "risk": {
       "type": "object",
       "required": [
        "level",
        "reasons"
       ],
       "properties": {
        "level": {
         "enum": [
          "low",
          "medium",
          "high"
         ],
         "type": "string"
        },
        "reasons": {
         "type": "array",
         "items": {
          "type": "string"
         },
         "description": "Human-readable evidence behind the level"
        }
       },
       "additionalProperties": false
      },
      "package": {
       "type": "object",
       "required": [
        "firstPublishedAt",
        "versionPublishedAt",
        "lastPublishedAt",
        "versionCount",
        "deprecated",
        "maintainerCount"
       ],
       "properties": {
        "deprecated": {
         "anyOf": [
          {
           "type": "string"
          },
         
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-risk-check-npm-pypi-supply-chain-verdict-aa063582/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.botsmith.dev](https://www.zero.xyz/host/x402.botsmith.dev/llms.txt)