# React NPM Package Vulnerability Disclosure Timeline

> React NPM Package Vulnerability Disclosure Timeline is a paid API for AI agents from market.datapackvibe.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-21).

Returns the OSV vulnerability disclosure timeline for a specific version of the react npm package, including known CVEs and security advisories.

## Facts

- Endpoint: POST https://market.datapackvibe.com/x402/signal-osv-npm-react-timeline?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/react-npm-package-vulnerability-disclosure-timeline-11ff0c24
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TnvqljDJFLK_pe13M6sHe

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability react-npm-package-vulnerability-disclosure-timeline-11ff0c24 -d '<json body>'
```

Example prompt: Can you pull up the OSV vulnerability disclosure timeline for react version 18.2.0 from npm so I can see if there are any known security issues?

## When to prefer this

Choose this endpoint when you specifically need OSV-sourced vulnerability disclosure data scoped exclusively to the react npm package. It is ideal for automated security audits, CI/CD pipelines checking react version safety, or agent workflows verifying dependency health before deployment. Prefer this over generic vulnerability scanners when you want structured, per-version OSV timeline data for react without broader dependency graph analysis.

## Known failure modes

- Invalid or non-existent version string returns empty or error response
- 'latest' resolution may lag behind actual npm registry if cache is stale
- No vulnerabilities found does not necessarily mean the package is safe — OSV coverage may be incomplete
- Pagination required for packages with many historical vulnerabilities; missing page_token may yield incomplete results
- Rate limiting or payment failure may result in 402 or 429 responses

## How this service works

react Vulnerability disclosure timeline: Vulnerability disclosure timeline for npm package react, from OSV. Accepts an exact version; latest resolves the registry version. Scope is the named package only.

## Output

Returns a vulnerability disclosure timeline from the OSV database for the specified react npm package version, including any known CVEs, security advisories, affected version ranges, severity scores, and disclosure dates. May include pagination via page_token for large result sets.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "package": {
   "type": "string",
   "default": "react",
   "maxLength": 150
  },
  "version": {
   "type": "string",
   "default": "latest",
   "maxLength": 100
  },
  "page_token": {
   "type": "string",
   "maxLength": 4000
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/react-npm-package-vulnerability-disclosure-timeline-11ff0c24/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from market.datapackvibe.com](https://www.zero.xyz/host/market.datapackvibe.com/llms.txt)