# relay402 NPM Package Check

> relay402 NPM Package Check is a paid API for AI agents from relay402.georgespring.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Checks an npm package name for security risk signals, returning a risk score, risk level, and supporting metadata — pay-per-call via USDC on Base, no API key required.

## Facts

- Endpoint: GET https://relay402.georgespring.workers.dev/api/npm-package-check
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relay402-npm-package-check-14971278
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_txvQJR-KWdzT6U9VdNjjy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relay402-npm-package-check-14971278
```

Example prompt: Can you check whether the npm package 'left-pad' is safe to use — I want to know its risk score and any security red flags before I add it as a dependency?

## When to prefer this

Choose this endpoint when an AI agent or autonomous workflow needs to programmatically vet an npm package for security risk without managing API keys or subscriptions — payment is the authentication via USDC on Base (x402 protocol). Ideal for supply-chain security checks embedded in CI/CD agents or coding assistants.

## Known failure modes

- Invalid package name format returns a 400 error
- Package not found on npm registry returns an error or null result
- Payment not included or insufficient causes a 402 Payment Required response
- Network or upstream registry timeout may return a 5xx error

## How this service works

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoint for CVE checks.

## Output

Returns a risk score (numeric), risk level (e.g. low/medium/high), and supporting package metadata and security signals for the queried npm package name.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "pattern": "^(@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$",
       "maxLength": 214
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relay402-npm-package-check-14971278/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from relay402.georgespring.workers.dev](https://www.zero.xyz/host/relay402.georgespring.workers.dev/llms.txt)