# Sourcevane Security - NPM Package Vulnerability Intelligence

> Sourcevane Security - NPM Package Vulnerability Intelligence is a paid API for AI agents from sourcevane-security-production.up.railway.app, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-12).

Returns a consolidated 0-100 priority score and vulnerability intelligence for an npm package by combining CVSS, EPSS exploit probability, CISA KEV active-exploitation status, and OSV affected package data.

## Facts

- Endpoint: GET https://sourcevane-security-production.up.railway.app/v1/intel/package/npm/lodash?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sourcevane-security-npm-package-vulnerability-intelligence-a6585aed
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_oSfm-K9yq6AmTqel9wIaX

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sourcevane-security-npm-package-vulnerability-intelligence-a6585aed
```

Example prompt: Can you pull the full vulnerability intelligence report for the npm package lodash — I want the combined priority score, how many CVEs it has, and whether any are actively being exploited in the wild right now?

## When to prefer this

Choose this endpoint when you need a single consolidated risk score for an npm package that combines multiple authoritative vulnerability sources (NVD, EPSS, CISA KEV, OSV) rather than querying each source separately. Ideal for automated dependency audits, CI/CD pipeline security gates, or agent workflows that need to triage which packages to patch first based on real-world exploit activity, not just CVSS severity alone.

## Known failure modes

- Package not found in NVD/OSV — returns empty vulnerability list or 404
- Network timeout if upstream data sources (NVD, EPSS, CISA KEV) are slow
- Payment not processed via x402 — returns 402 Payment Required
- Invalid ecosystem or package name format — returns 400 Bad Request
- Rate limiting if too many calls in short succession

## How this service works

Pay-per-call vulnerability intelligence for AI agents: CVSS (NVD) + exploit probability (EPSS) + active-exploitation status (CISA KEV) + affected packages (OSV), joined into a single 0-100 priority score, billed per call over x402.

## Output

A JSON object containing a 0-100 priority score (highestPriority), total vulnerability count, and underlying signals including CVSS severity, EPSS exploit probability, CISA KEV active-exploitation flag, and OSV-derived affected package version ranges for the queried npm package.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "highestPriority": 80,
  "vulnerabilityCount": 1
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sourcevane-security-npm-package-vulnerability-intelligence-a6585aed/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sourcevane-security-production.up.railway.app](https://www.zero.xyz/host/sourcevane-security-production.up.railway.app/llms.txt)