# Stack Facts Package Security & Metadata Lookup

> Stack Facts Package Security & Metadata Lookup is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-19).

Returns security, vulnerability, deprecation, license, and end-of-life metadata for a software package by ecosystem and name, paid per-call in USDC via x402.

## Facts

- Endpoint: GET https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/package/%7Becosystem%7D/%7Bname%7D?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-package-security-metadata-lookup-f87e9ad4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fZ_o4G6L8Sh9CoWsKYZh2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-package-security-metadata-lookup-f87e9ad4
```

Example prompt: Before I install the npm package 'request', can you check if it has any known vulnerabilities, CVEs, malware issues, or deprecation warnings using Stack Facts?

## When to prefer this

Choose this endpoint when an AI agent needs machine-readable, signed, authoritative security and license metadata about an open source package without setting up an account or API key. It is ideal for automated dependency vetting pipelines, CI/CD security gates, or agent workflows where micropayment-per-call (USDC via x402) is acceptable and trusted signed answers are required. Prefer this over scraping package registries directly or using unauthenticated OSV APIs when you need aggregated, normalized data (malware + CVE + CISA KEV + EOL + license) in a single call.

## Known failure modes

- Package or ecosystem not found — returns 404 or empty data
- Invalid ecosystem parameter — unrecognized ecosystem strings may fail
- Payment not accepted — x402 payment flow failure results in 402 response
- Stale data — meta.stale flag may be true if upstream data is outdated
- Network timeout — upstream registry or OSV API unavailable

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

A JSON object containing the package's name, ecosystem, PURL, version info, deprecation and yanked status, license details (SPDX, FSF/OSI flags), homepage, repository, published dates, plus security signals from OSV vulnerabilities and CISA KEV exploited CVEs, and provenance/attribution metadata.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "name": "request",
   "purl": "pkg:npm/request@2.88.2",
   "notice": "request has been deprecated, se…",
   "yanked": false,
   "licence": {
    "from": "license",
    "name": "Apache License 2.0",
    "spdx": "Apache-2.0",
    "declared": "Apache-2.0",
    "fsf_libre": true,
    "osi_approved": true,
    "deprecated_id": false
   },
   "version": "2.88.2",
   "homepage": "https://github.com/request/requ…",
   "requires": {
    "node": ">= 6"
   },
   "ecosystem": "npm",
   "is_latest": true,
   "deprecated": true,
   "repository": "https://github.com/request/requ…",
   "published_at": "2020-02-11T16:35:36.122Z",
   "registry_url": "https://www.npmjs.com/package/r…",
   "latest_version": "2.88.2",
   "versions_count": 3,
   "latest_published_at": "2020-02-11T16:35:36.122Z"
  },
  "meta": {
   "stale": false,
   "notice": "Normalised (modified) from the …",
   "source": "https://registry.npmjs.org/",
   "dataset": "package",
   "licences": "/licences",
   "attribution": "Package metadata from the npm r…",
   "retrieved_at": "2026-10-09T07:00:00.000Z",
   "spdx_list_version": "3.29.0"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-package-security-metadata-lookup-f87e9ad4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)