Package Security & Metadata Lookup (npm, PyPI, crates.io)

{
  "type": "json",
  "example": {
    "note": "exists means the registry listed this name when we looked. It is not a security verdict: the package may still be malicious, unmaintained or not the one you meant; description and licence are the publisher's own text. vulnerabilities lists known OSV.dev advisories for the version shown (the one you sent, else the latest; name only when the registry does not list the name and no version was sent); none listed does not mean the package has no flaws, and advisory summaries are third-party text. Vulnerability data: OSV.dev (GitHub Advisory Database and PyPI Advisory Database, CC-BY 4.0; RustSec, CC0; OpenSSF Malicious Packages, Apache 2.0), see https://github.com/advisories.",
    "tier": "paid",
    "receipt": "eyJ…",
    "results": [
      {
        "name": "left-pad",
        "exists": true,
        "status": "found",
        "yanked": null,
        "license": "WTFPL",
        "signals": [
          "deprecated"
        ],
        "homepage": "https://github.com/stevemao/left-pad#readme",
        "ecosystem": "npm",
        "created_at": "2014-03-14T09:09:20.762Z",
        "deprecated": "use String.prototype.padStart()",
        "raw_sha256": "…",
        "repository": "git+ssh://git@github.com/stevemao/left-pad.git",
        "description": "String left pad",
        "registry_url": "https://www.npmjs.com/package/left-pad",
        "latest_version": "1.3.0",
        "vulnerabilities": {
          "count": 0,
          "items": [],
          "reason": null,
          "status": "checked",
          "version": "1.3.0",
          "truncated": false
        }
      }
    ]
  }
}