# Stack Facts OSV Package Vulnerability Check

> Stack Facts OSV Package Vulnerability Check is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-13).

Checks one or more packages (via PURL, lockfile) for malware, OSV vulnerabilities, CISA KEV exploited CVEs, and end-of-life status, returning signed results paid per-call in USDC

## Facts

- Endpoint: POST https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/osv/check?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-osv-package-vulnerability-check-acc14499
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VU4gHK5bFKOBQ8XGGZCBv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-osv-package-vulnerability-check-acc14499 -d '<json body>'
```

Example prompt: Before I install lodash@4.17.20 from npm, can you check if it has any known vulnerabilities, whether it appears in the CISA exploited CVEs list, or if it's been flagged as malicious?

## When to prefer this

Choose this endpoint when you need cryptographically signed, pay-per-call vulnerability data with no account setup — ideal for AI agents doing automated dependency audits in CI/CD pipelines, pre-install checks, or supply chain risk assessments. Prefer it over free OSV API wrappers when you need combined OSV + CISA KEV + malware signals in a single call, signed responses for auditability, and when operating without persistent API keys. Best for spot checks of up to 50 packages per call.

## Known failure modes

- Invalid PURL format causes validation error — PURLs must start with 'pkg:'
- Lockfile format mismatch — submitted lockfile content does not match declared format enum
- Package version not found in OSV — returns no advisories but does not error
- Stale dataset flag set to true if OSV or KEV data is older than cadence window
- Payment failure or insufficient USDC balance returns HTTP 402
- Empty packages array or missing required fields returns 400 validation error
- Network timeout for large lockfiles with many packages

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

Returns per-package results including: vulnerability advisories with CVE aliases, severity labels, fixed versions, KEV flag, malicious flag, and ecosystem; plus a summary with counts of affected packages, KEV hits, malicious packages, and total advisories; plus signed dataset metadata (OSV snapshot ID, KEV catalog version, SHA256, signature) confirming data freshness and provenance.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "format": {
   "enum": [
    "package-lock.json",
    "yarn.lock",
    "requirements.txt",
    "poetry.lock"
   ],
   "type": "string"
  },
  "lockfile": {
   "type": "string",
   "minLength": 1
  },
  "packages": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^pkg:",
    "maxLength": 512,
    "minLength": 7
   },
   "maxItems": 50,
   "minItems": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "count": 2,
   "results": [
    {
     "kev": false,
     "name": "lodash",
     "purl": "pkg:npm/lodash@4.17.20",
     "status": "affected",
     "version": "4.17.20",
     "ecosystem": "npm",
     "malicious": false,
     "advisories": [
      {}
     ]
    }
   ],
   "summary": {
    "in_kev": 1,
    "affected": 2,
    "packages": 2,
    "malicious": 0,
    "advisories": 2,
    "unanswered": 0,
    "versions_unknown": 0,
    "no_known_advisories": 0
   },
   "kev_catalog_version": "2026.10.10"
  },
  "meta": {
   "stale": false,
   "notice": "Normalised (modified) from the …",
   "dataset": "osv",
   "datasets": {
    "kev": {},
    "osv": {}
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-osv-package-vulnerability-check-acc14499/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)