# Stack Facts: Package Security & Vulnerability Check

> Stack Facts: Package Security & Vulnerability Check is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.012/call, status unknown (last checked 2026-10-13).

Checks packages, purls, or CVEs for malware, OSV vulnerabilities, CISA KEV exploited CVEs, and end-of-life status, returning signed results payable per-call in USDC

## Facts

- Endpoint: POST https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/stack/check?utm_source=zero.xyz
- Price: $0.012/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-package-security-vulnerability-check-7140b31b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3QyO-GkWqTAuCpdRAKHDE

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-package-security-vulnerability-check-7140b31b -d '<json body>'
```

Example prompt: Before I install lodash@4.17.20 and express@4.18.2, can you check both packages for malware, known vulnerabilities, exploited CVEs from the CISA list, and whether either is end-of-life?

## When to prefer this

Choose this endpoint when you need a single call to cross-reference a package or CVE across multiple authoritative security data sources (OSV, CISA KEV, endoflife.date) simultaneously, with cryptographically signed responses and no account setup. Prefer this over raw OSV or CISA APIs when you want normalized, aggregated results with malware detection and EOL status in one payload, and when pay-per-use USDC micropayment model fits better than subscription API keys.

## Known failure modes

- Payment not provided or insufficient USDC — 402 Payment Required
- Invalid purl format (must start with 'pkg:') — schema validation error
- CVE format mismatch (must match CVE-YYYY-NNNNN pattern) — validation rejection
- Too many items submitted (>50 packages or >100 CVEs) — request rejected
- Unknown package or version not found in OSV — returned as unanswered/unknown in results
- Stale dataset flag set to true if upstream data sources haven't refreshed recently

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

A structured JSON object containing: per-package OSV vulnerability advisories (with affected/malicious status), CISA KEV membership per CVE, end-of-life status per product/version, a summary counts object, and dataset metadata including signatures, source attribution, and freshness timestamps for each data source (OSV, KEV, EOL).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "cves": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^[Cc][Vv][Ee]-\\d{4}-\\d{4,}$",
    "maxLength": 32
   },
   "maxItems": 100,
   "minItems": 0
  },
  "items": {
   "type": "array",
   "items": {
    "anyOf": [
     {
      "type": "string",
      "pattern": "^[^@]+@.+$",
      "maxLength": 401,
      "minLength": 3
     },
     {
      "type": "object",
      "required": [
       "product",
       "version"
      ],
      "properties": {
       "product": {
        "type": "string",
        "maxLength": 200,
        "minLength": 1
       },
       "version": {
        "type": "string",
        "maxLength": 200,
        "minLength": 1
       }
      },
      "additionalProperties": false
     }
    ]
   },
   "maxItems": 50,
   "minItems": 0
  },
  "packages": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^pkg:",
    "maxLength": 512,
    "minLength": 7
   },
   "maxItems": 50,
   "minItems": 0
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "eol": {
    "count": 2,
    "matched": 2,
    "results": [
     {}
    ],
    "unknown": [],
    "unknown_count": 0
   },
   "kev": {
    "count": 2,
    "in_kev": 1,
    "results": [
     {}
    ],
    "catalog_version": "2026.10.10"
   },
   "osv": {
    "count": 1,
    "results": [
     {}
    ],
    "summary": {},
    "kev_catalog_version": "2026.10.10"
   },
   "summary": {
    "cves": 2,
    "items": 2,
    "in_kev": 1,
    "matched": 2,
    "unknown": 0,
    "packages": 1,
    "by_status": {},
    "packages_in_kev": 0,
    "packages_affected": 1
   }
  },
  "meta": {
   "stale": false,
   "notice": "Normalised (modified) from the …",
   "dataset": "stack",
   "datasets": {
    "eol": {},
    "kev": {},
    "osv": {}
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-package-security-vulnerability-check-7140b31b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)