# Surefact Package Vulnerability Checker

> Surefact Package Vulnerability Checker is a paid API for AI agents from api.surefact.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-14).

Checks a package version across npm, PyPI, Crates, RubyGems, Go, NuGet, or Packagist for known vulnerabilities, deprecation, and upgrade advice

## Facts

- Endpoint: GET https://api.surefact.workers.dev/v1/package?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/surefact-package-vulnerability-checker-2f2f4a14
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_eRrSGnGJS95zNdE_PSbmc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability surefact-package-vulnerability-checker-2f2f4a14
```

Example prompt: Can you check if lodash 4.17.15 on npm has any known vulnerabilities and tell me what version I should upgrade to?

## When to prefer this

Choose this endpoint when you need verified, source-checked vulnerability data for a specific package version across the major ecosystems (npm, PyPI, Crates, RubyGems, Go, NuGet, Packagist) without setting up an API key. It is ideal for AI agents performing automated dependency audits inside CI/CD workflows, code review assistants, or any agent that needs actionable upgrade advice with proof. Prefer it over generic LLM knowledge when freshness and verifiability matter, since results are checked against live registries and OSV advisories.

## Known failure modes

- Package not found in the specified ecosystem — exists field returns false
- Unknown or unsupported ecosystem value returns a validation error
- Version string not found or unresolvable tag/branch — falls back to latest
- Network or registry timeout returning a 5xx with no charge
- Malformed query parameters return a 400 error

## How this service works

Verified, pay-per-call tools for AI agents: read web pages, check emails, audit DNS and domains, convert currencies, vet package versions for vulnerabilities, and roll provably fair dice for games. Every answer is checked against its source or comes with a proof. No signup or API key: pay each call in USDC on Base with x402. Failed calls are never charged.

## Output

Returns a JSON object with the package name, ecosystem, checked version, latest version, deprecation status, yanked status, list of vulnerabilities (each with GHSA/CVE ID, severity, CVSS score, summary, and fixed-in version), a recommended safe upgrade version, safe install command, registry URL, and an advice string summarizing what action to take. Failed calls are never charged.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name (Go: module path; Packagist: vendor/package)."
      },
      "version": {
       "type": "string",
       "description": "Version to check for deprecation and vulnerabilities (default: latest). A tag or branch (npm dist-tag, Go branch) is reported as the version it resolves to."
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi",
        "crates",
        "rubygems",
        "go",
        "nuget",
        "packagist"
       ],
       "type": "string",
       "description": "Package ecosystem."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "name": "lodash",
  "advice": "Upgrade to 4.18.0 or later (fixes 4 advisories: 2 high, 2 moderate). Latest 4.18.1 has no known advisories.",
  "exists": true,
  "latest": "4.18.1",
  "yanked": false,
  "install": "npm install lodash@4.17.15",
  "version": "4.17.15",
  "ecosystem": "npm",
  "checked_at": "2026-10-13T12:00:00.000Z",
  "deprecated": false,
  "install_safe": "npm install lodash@4.18.0",
  "registry_url": "https://www.npmjs.com/package/lodash",
  "safe_upgrade": "4.18.0",
  "vulnerabilities": [
   {
    "id": "GHSA-r5fr-rjxr-66jc",
    "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc",
    "aliases": [
     "CVE-2021-23337",
     "CVE-2026-4800",
     "GHSA-35jh-r3h4-6jhm"
    ],
    "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
    "fixed_in": "4.18.0",
    "severity": "high",
    "published": "2026-04-01",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "fixed_in_by_id": {
     "GHSA-35jh-r3h4-6jhm": "4.17.21",
     "GHSA-r5fr-rjxr-66jc": "4.18.0"
    }
   },
   {
    "id": "GHSA-p6mc-m468-83gw",
    "url": "https://osv.dev/vulnerability/GHSA-p6mc-m468-83gw",
    "aliases": [
     "CVE-2020-8203"
    ],
    "summary": "Prototype Pollution in lodash",
    "fixed_in": "4.17.19",
    "severity": "high",
    "published": "2020-07-15",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
   },
   {
    "id": "GHSA-f23m-r3pf-42rh",
    "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh",
    "aliases": [
     "CVE-2025-13465",
     "CVE-2026-2950",
     "GHSA-xxjr-mmjv-4gpg"
    ],
    "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
    "fixed_in": "4.18.0",
    "severity": "moderate",
    "published": "2026-04-01",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
    "fixed_in_by_id": {
     "GHSA-f23m-r3pf-42rh": "4.18.0",
     "GHSA-xxjr-mmjv-4gpg": "4.17.23"
    }
   },
   {
    "id": "GHSA-29mw-wpgm-hmr9",
    "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
    "aliases": [
     "CVE-2020-28500"
    ],
    "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
    "fixed_in": "4.17.21",
    "severity": "moderate",
    "published": "2022-01-06",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
   }
  ],
  "vulnerabil
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/surefact-package-vulnerability-checker-2f2f4a14/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.surefact.workers.dev](https://www.zero.xyz/host/api.surefact.workers.dev/llms.txt)