# pkgpulse deps-audit

> pkgpulse deps-audit is a paid API for AI agents from pkgpulse.letom1176.workers.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Audits a set of npm package dependencies for health issues, typosquatting, deprecation, install scripts, and hallucinated/non-existent packages

## Facts

- Endpoint: POST https://pkgpulse.letom1176.workers.dev/api/deps-audit
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pkgpulse-deps-audit-59f16874
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zCEcri1LX-7jcSkSss8vk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pkgpulse-deps-audit-59f16874 -d '<json body>'
```

Example prompt: Can you audit these npm dependencies from my AI-generated package.json — I want to know if any packages are typosquatted, deprecated, hallucinated (not on the registry), or have suspicious install scripts: { "express": "^4.18.0", "leftt-pad": "^1.0.0", "lodash": "^4.17.21" }?

## When to prefer this

Use this endpoint when you need to validate npm dependencies before installation — especially for AI-generated code where hallucinated package names are a real risk, or when doing pre-deploy security checks for typosquatting and supply chain attacks. It is particularly valuable over a generic npm audit because it specifically flags non-existent registry entries (hallucination/squat vector), not just known vulnerabilities. Prefer this over manual checks when auditing many packages at once in an automated pipeline.

## Known failure modes

- Invalid or empty dependencies input returns an error
- Package names that are valid but newly published may not be indexed yet
- Rate limiting or payment failure (x402 USDC payment not processed) blocks the request
- Malformed package.json structure may cause parsing errors
- Network timeouts reaching the npm registry for live checks

## How this service works

Dependency intelligence for AI coding agents, paid per-call via x402 (USDC on Base): npm package health scores with a disclosed rubric, typosquat checks, dependency audits. Free index at /, free sample at /api/sample.

## Output

Returns a JSON object with a summary count of clean, audited, deprecated, packages with install scripts, and missing-from-registry packages; a human-readable verdict string (e.g. STOP or PASS); and a worst_offenders array listing flagged packages with specific flag descriptions such as typosquat alerts, deprecation notices, registry absence, or install script warnings.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "dependencies": {
   "type": "object",
   "description": "package.json-style dependencies map (name → version range). Or send a full package.json, or an array of names."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "summary": {
   "clean": 8,
   "audited": 12,
   "deprecated": 1,
   "with_install_scripts": 2,
   "missing_from_registry": 1
  },
  "verdict": "STOP: dependencies reference names that do not exist on npm — classic hallucination/squat vector",
  "worst_offenders": [
   {
    "name": "leftt-pad",
    "flags": [
     "NOT ON REGISTRY — hallucinated or removed; install will fail or fetch a squat"
    ]
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pkgpulse-deps-audit-59f16874/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pkgpulse.letom1176.workers.dev](https://www.zero.xyz/host/pkgpulse.letom1176.workers.dev/llms.txt)