# Safe Upgrade Decision API – npm Malicious Scan

> Safe Upgrade Decision API – npm Malicious Scan is a paid API for AI agents from x402-safe-upgrade-api.onrender.com, paid per call via x402, $0.03/call, status down (last checked 2026-09-15).

Scans an npm package (and optional version) for malicious activity and returns an evidence-backed upgrade verdict with a risk score.

## Facts

- Endpoint: POST https://x402-safe-upgrade-api.onrender.com/v1/malicious-scan
- Price: $0.03/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/safe-upgrade-decision-api-npm-malicious-scan-6ebebaf6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dImntklc07vutE5GAbd39

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability safe-upgrade-decision-api-npm-malicious-scan-6ebebaf6 -d '<json body>'
```

Example prompt: Before I install it, can you scan the npm package 'lodash' version '4.17.21' for malicious activity and tell me if it's safe to upgrade to?

## When to prefer this

Choose this endpoint when an AI coding agent needs an automated, evidence-backed go/no-go signal before installing or upgrading an npm package, especially in automated CI/CD pipelines or agentic workflows where human review is not practical. It is particularly valuable for catching malicious packages that may pass basic audit checks, and for getting a quantitative risk score rather than a simple binary safe/unsafe flag.

## Known failure modes

- Unknown package name returns an error or null verdict
- Specific version not found in registry causes a lookup failure
- Network timeout if the upstream npm registry or threat intelligence feeds are slow
- Invalid input schema (missing packageName) returns a 400-level error
- Very new packages may have insufficient data for a confident verdict

## How this service works

Evidence-backed npm package upgrade decisions for coding agents.

## Output

Returns a JSON object with a 'verdict' string (e.g. 'REVIEW BEFORE INSTALLING', 'SAFE', 'MALICIOUS') and a 'riskScore' integer (0–100), where higher scores indicate greater risk. The verdict provides an actionable recommendation and the risk score gives a quantitative measure of potential danger.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "version": {
   "type": "string",
   "description": "Exact version; omit for latest."
  },
  "packageName": {
   "type": "string",
   "description": "Exact npm package name."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "verdict": "REVIEW BEFORE INSTALLING",
  "riskScore": 35
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/safe-upgrade-decision-api-npm-malicious-scan-6ebebaf6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-safe-upgrade-api.onrender.com](https://www.zero.xyz/host/x402-safe-upgrade-api.onrender.com/llms.txt)