{
  "x402Version": 2,
  "id": 30809,
  "slug": "30809",
  "resource": "https://fiatdock.com/v1/dev/package",
  "description": "Is an npm or PyPI package version safe and maintained? Known vulnerabilities from OSV.dev (ids, CVEs, the advisory's own severity, fixed versions), deprecation or yank, licence, repository, publish dates, latest version, weekly downloads, dependency and maintainer counts, stated risk flags. No code scanning; unknowns are null. An unknown package or an outage is not charged. Pay-per-call via x402.",
  "type": "http",
  "serviceName": "FiatDock",
  "resourceType": "Security",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0xeB12bB2f52EeD33DBa6A00774E48324032Fd87C6",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "2700",
      "amountUsd": 0.0027,
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "properties": {
      "example": {
        "type": "object"
      },
      "type": {
        "type": "string"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "ecosystem": "npm",
            "name": "lodash",
            "version": "4.17.20"
          },
          "bodyType": "json",
          "method": "POST",
          "type": "http"
        },
        "output": {
          "example": {
            "asOf": "2026-10-08T16:18:31.547Z",
            "daysSinceLatestRelease": 189,
            "dependencyCount": 0,
            "deprecated": null,
            "description": "Lodash modular utilities.",
            "downloadsLastWeek": 203122461,
            "ecosystem": "npm",
            "homepage": "https://lodash.com/",
            "isLatest": false,
            "latestPublishedAt": "2026-04-01T21:01:20.458Z",
            "latestVersion": "4.18.1",
            "license": "MIT",
            "maintainersCount": 1,
            "name": "lodash",
            "note": "Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0).",
            "osvRecords": 5,
            "publishedAt": "2020-08-13T16:53:54.152Z",
            "repository": "https://github.com/lodash/lodash",
            "riskFlags": [
              "known_vulnerabilities",
              "high_or_critical_vulnerability",
              "newer_version_available"
            ],
            "source": "npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev",
            "version": "4.17.20",
            "vulnerabilities": [
              {
                "aliases": [
                  "CVE-2021-23337",
                  "CVE-2026-4800",
                  "GHSA-r5fr-rjxr-66jc"
                ],
                "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "fixedIn": [
                  "4.17.21"
                ],
                "id": "GHSA-35jh-r3h4-6jhm",
                "published": "2021-05-06T16:05:51.000Z",
                "severity": "HIGH",
                "summary": "Command Injection in lodash",
                "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
              },
              {
                "aliases": [
                  "CVE-2021-23337",
                  "CVE-2026-4800",
                  "GHSA-35jh-r3h4-6jhm"
                ],
                "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "fixedIn": [
                  "4.18.0"
                ],
                "id": "GHSA-r5fr-rjxr-66jc",
                "published": "2026-04-01T23:51:12.000Z",
                "severity": "HIGH",
                "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
                "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"
              },
              {
                "aliases": [
                  "CVE-2020-28500"
                ],
                "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "fixedIn": [
                  "4.17.21"
                ],
                "id": "GHSA-29mw-wpgm-hmr9",
                "published": "2022-01-06T20:30:46.000Z",
                "severity": "MODERATE",
                "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
                "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
              },
              {
                "aliases": [
                  "CVE-2025-13465",
                  "CVE-2026-2950",
                  "GHSA-xxjr-mmjv-4gpg"
                ],
                "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "fixedIn": [
                  "4.18.0"
                ],
                "id": "GHSA-f23m-r3pf-42rh",
                "published": "2026-04-01T23:50:27.000Z",
                "severity": "MODERATE",
                "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
                "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh"
              },
              {
                "aliases": [
                  "CVE-2025-13465",
                  "CVE-2026-2950",
                  "GHSA-f23m-r3pf-42rh"
                ],
                "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "fixedIn": [
                  "4.17.23"
                ],
                "id": "GHSA-xxjr-mmjv-4gpg",
                "published": "2026-01-21T23:01:22.000Z",
                "severity": "MODERATE",
                "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
                "url": "https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg"
              }
            ],
            "vulnerabilityCount": 5
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "properties": {
                  "ecosystem": {
                    "description": "Which registry the name is on: npm (default) or pypi",
                    "enum": [
                      "npm",
                      "pypi"
                    ],
                    "example": "npm",
                    "type": "string"
                  },
                  "name": {
                    "description": "The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)",
                    "example": "lodash",
                    "maxLength": 214,
                    "type": "string"
                  },
                  "version": {
                    "description": "An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused",
                    "example": "4.17.20",
                    "maxLength": 65,
                    "type": "string"
                  }
                },
                "required": []
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "security",
    "dependencies",
    "npm",
    "pypi",
    "supply-chain",
    "bazaar"
  ],
  "sourceHost": "fiatdock.com",
  "lastUpdated": "2026-10-13T12:46:07.623Z",
  "quality": {
    "calls30d": 3,
    "uniquePayers30d": 2,
    "lastCalledAt": "2026-10-13T12:46:07.422Z"
  },
  "metadata": {
    "serviceName": "FiatDock",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "ecosystem": "npm",
              "name": "lodash",
              "version": "4.17.20"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "asOf": "2026-10-08T16:18:31.547Z",
              "daysSinceLatestRelease": 189,
              "dependencyCount": 0,
              "deprecated": null,
              "description": "Lodash modular utilities.",
              "downloadsLastWeek": 203122461,
              "ecosystem": "npm",
              "homepage": "https://lodash.com/",
              "isLatest": false,
              "latestPublishedAt": "2026-04-01T21:01:20.458Z",
              "latestVersion": "4.18.1",
              "license": "MIT",
              "maintainersCount": 1,
              "name": "lodash",
              "note": "Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0).",
              "osvRecords": 5,
              "publishedAt": "2020-08-13T16:53:54.152Z",
              "repository": "https://github.com/lodash/lodash",
              "riskFlags": [
                "known_vulnerabilities",
                "high_or_critical_vulnerability",
                "newer_version_available"
              ],
              "source": "npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev",
              "version": "4.17.20",
              "vulnerabilities": [
                {
                  "aliases": [
                    "CVE-2021-23337",
                    "CVE-2026-4800",
                    "GHSA-r5fr-rjxr-66jc"
                  ],
                  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  "fixedIn": [
                    "4.17.21"
                  ],
                  "id": "GHSA-35jh-r3h4-6jhm",
                  "published": "2021-05-06T16:05:51.000Z",
                  "severity": "HIGH",
                  "summary": "Command Injection in lodash",
                  "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
                },
                {
                  "aliases": [
                    "CVE-2021-23337",
                    "CVE-2026-4800",
                    "GHSA-35jh-r3h4-6jhm"
                  ],
                  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "fixedIn": [
                    "4.18.0"
                  ],
                  "id": "GHSA-r5fr-rjxr-66jc",
                  "published": "2026-04-01T23:51:12.000Z",
                  "severity": "HIGH",
                  "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
                  "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"
                },
                {
                  "aliases": [
                    "CVE-2020-28500"
                  ],
                  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "fixedIn": [
                    "4.17.21"
                  ],
                  "id": "GHSA-29mw-wpgm-hmr9",
                  "published": "2022-01-06T20:30:46.000Z",
                  "severity": "MODERATE",
                  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
                  "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
                },
                {
                  "aliases": [
                    "CVE-2025-13465",
                    "CVE-2026-2950",
                    "GHSA-xxjr-mmjv-4gpg"
                  ],
                  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  "fixedIn": [
                    "4.18.0"
                  ],
                  "id": "GHSA-f23m-r3pf-42rh",
                  "published": "2026-04-01T23:50:27.000Z",
                  "severity": "MODERATE",
                  "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
                  "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh"
                },
                {
                  "aliases": [
                    "CVE-2025-13465",
                    "CVE-2026-2950",
                    "GHSA-f23m-r3pf-42rh"
                  ],
                  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  "fixedIn": [
                    "4.17.23"
                  ],
                  "id": "GHSA-xxjr-mmjv-4gpg",
                  "published": "2026-01-21T23:01:22.000Z",
                  "severity": "MODERATE",
                  "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
                  "url": "https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg"
                }
              ],
              "vulnerabilityCount": 5
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "properties": {
                    "ecosystem": {
                      "description": "Which registry the name is on: npm (default) or pypi",
                      "enum": [
                        "npm",
                        "pypi"
                      ],
                      "example": "npm",
                      "type": "string"
                    },
                    "name": {
                      "description": "The package name: an npm package (lodash, @types/node) or a PyPI project (requests, Django)",
                      "example": "lodash",
                      "maxLength": 214,
                      "type": "string"
                    },
                    "version": {
                      "description": "An exact published version to analyse (4.17.20, 2.31.0). Omit for the latest release; ranges like ^4 are refused",
                      "example": "4.17.20",
                      "maxLength": 65,
                      "type": "string"
                    }
                  },
                  "required": []
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "fiatdock.com",
    "manifest_name": "fiatdock.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-14T01:15:01.050Z"
  },
  "exampleResponse": {
    "example": {},
    "type": "string"
  }
}