# Package Security & Metadata Lookup (npm, PyPI, crates.io)

> Package Security & Metadata Lookup (npm, PyPI, crates.io) is a paid API for AI agents from vehcdj664efetfrsolne5umanq.srv.us, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-17).

Checks 1–10 npm, PyPI, or crates.io packages for existence, metadata, deprecation status, and known OSV.dev vulnerability advisories

## Facts

- Endpoint: POST https://vehcdj664efetfrsolne5umanq.srv.us/v1/check/packages?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/package-security-metadata-lookup-npm-pypi-crates-io-b77554b8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dVAYrV5Qudq2C6cAAm-ha

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability package-security-metadata-lookup-npm-pypi-crates-io-b77554b8 -d '<json body>'
```

Example prompt: Check whether the npm packages 'lodash' version 4.17.20 and 'left-pad' have any known vulnerabilities or are deprecated, and tell me their licenses.

## When to prefer this

Use this endpoint when you need a quick, paid, signed lookup of package security and metadata from a neutral third-party service covering npm, PyPI, and crates.io in a single call. Prefer it over manual registry scraping when you need OSV advisory data bundled with package metadata, or when you need a signed receipt for auditability. Best for agents doing dependency vetting, CI/CD pre-checks, or security reviews where up to 10 packages need to be assessed at once.

## Known failure modes

- Package name not found in registry — returns exists: false with status 'not found'
- Invalid ecosystem value (not npm/pypi/crates) — request validation error
- More than 10 packages submitted — rejected by minItems/maxItems constraint
- Payment failure via x402 protocol — 402 response before data is returned
- Version string longer than 64 characters — validation error
- Advisory data temporarily unavailable from OSV.dev — vulnerabilities status may reflect partial data

## How this service works

Signed evidence about web pages, for AI agents. Ask whether a quote appears on a page or check every citation in an answer at once, fetch a page and learn…

## Output

Returns a JSON array of results per package, each including: existence status (found/not found), latest or requested version, license, deprecation notice if any, creation date, repository and homepage URLs, registry URL, and a vulnerabilities object listing OSV.dev advisory count and items for the checked version. Also includes a signed receipt and advisory data attribution.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "packages": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "ecosystem",
     "name"
    ],
    "properties": {
     "name": {
      "type": "string",
      "description": "Package name as you would install it (npm names may be scoped: @scope/name)."
     },
     "version": {
      "type": "string",
      "maxLength": 64,
      "description": "Optional: the version you will install (e.g. a pinned 4.17.20). Advisories are then listed for this version; without it, for the latest."
     },
     "ecosystem": {
      "enum": [
       "npm",
       "pypi",
       "crates"
      ],
      "type": "string"
     }
    },
    "additionalProperties": false
   },
   "maxItems": 10,
   "minItems": 1,
   "description": "1 to 10 packages to look up. Each is { ecosystem, name, version? }; ecosystem is npm, pypi or crates (crates.io)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "note": "exists means the registry listed this name when we looked. It is not a security verdict: the package may still be malicious, unmaintained or not the one you meant; description and licence are the publisher's own text. vulnerabilities lists known OSV.dev advisories for the version shown (the one you sent, else the latest; name only when the registry does not list the name and no version was sent); none listed does not mean the package has no flaws, and advisory summaries are third-party text. Vulnerability data: OSV.dev (GitHub Advisory Database and PyPI Advisory Database, CC-BY 4.0; RustSec, CC0; OpenSSF Malicious Packages, Apache 2.0), see https://github.com/advisories.",
  "tier": "paid",
  "receipt": "eyJ…",
  "results": [
   {
    "name": "left-pad",
    "exists": true,
    "status": "found",
    "yanked": null,
    "license": "WTFPL",
    "signals": [
     "deprecated"
    ],
    "homepage": "https://github.com/stevemao/left-pad#readme",
    "ecosystem": "npm",
    "created_at": "2014-03-14T09:09:20.762Z",
    "deprecated": "use String.prototype.padStart()",
    "raw_sha256": "…",
    "repository": "git+ssh://git@github.com/stevemao/left-pad.git",
    "description": "String left pad",
    "registry_url": "https://www.npmjs.com/package/left-pad",
    "latest_version": "1.3.0",
    "vulnerabilities": {
     "count": 0,
     "items": [],
     "reason": null,
     "status": "checked",
     "version": "1.3.0",
     "truncated": false
    }
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/package-security-metadata-lookup-npm-pypi-crates-io-b77554b8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from vehcdj664efetfrsolne5umanq.srv.us](https://www.zero.xyz/host/vehcdj664efetfrsolne5umanq.srv.us/llms.txt)