# Paket Dependency Confusion Checker

> Paket Dependency Confusion Checker is a paid API for AI agents from paket.halowerk.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-14).

Checks internally-used package names against public registries to detect dependency confusion vulnerabilities — flagging names that are unclaimed, taken by unrelated parties, or otherwise at risk.

## Facts

- Endpoint: POST https://paket.halowerk.com/v1/dependency-confusion
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paket-dependency-confusion-checker-d0d9cbf1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_axbegF75Yt_99_sfc63-G

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paket-dependency-confusion-checker-d0d9cbf1 -d '<json body>'
```

Example prompt: Check these internal package names — @acme/auth-client, @acme/data-layer, and @acme/ui-kit — against the public npm registry and tell me which ones are unclaimed (so we should register them) and which are already taken by unrelated projects.

## When to prefer this

Use this endpoint when you need to specifically assess dependency confusion risk — i.e., when the question is whether internal package names are safely distinct from public registry entries. Prefer it over generic package lookup endpoints when you have a list of internally-used names and want a security-focused, categorized finding rather than raw registry data.

## Known failure modes

- Unknown or unsupported ecosystem returns a validation error
- Rate limiting if a large batch of names is submitted rapidly
- Registry lookup timeouts if the upstream public registry is slow or unavailable
- Ambiguous ecosystem specification may return results for the wrong registry
- Empty or malformed name list returns a 400-level error

## How this service works

Takes the names your organisation publishes internally and checks each against the public registry of the same ecosystem. Three findings, kept apart because they call for different actions. Name is free: nobody has taken it, the door is open but unattended, and the answer is to reserve the name yourself. Name is taken and old: probably an unrelated project that happens to share the name, worth confirming but rarely urgent.

## Output

Returns a structured set of findings split into distinct categories: names that are free (unclaimed on the public registry, candidate for reservation), names that are taken by an apparently unrelated project (potential confusion risk to investigate), and any additional risk signals. Each finding includes the package name, ecosystem, and recommended action.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "system": {
   "enum": [
    "npm",
    "pypi",
    "maven",
    "go",
    "cargo",
    "nuget",
    "rubygems"
   ],
   "type": "string"
  },
  "packages": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "name"
    ],
    "properties": {
     "name": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1
     },
     "internal_version": {
      "type": "string",
      "maxLength": 60
     }
    },
    "additionalProperties": false
   },
   "maxItems": 60,
   "minItems": 1,
   "description": "Your internal package names, optionally with the internal version."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paket-dependency-confusion-checker-d0d9cbf1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paket.halowerk.com](https://www.zero.xyz/host/paket.halowerk.com/llms.txt)