{
  "x402Version": 2,
  "id": 34025,
  "slug": "34025",
  "resource": "https://api.zfinia.com/x402/v1/lockfile-change-report",
  "description": "Compare two lockfiles and report what a manifest diff cannot see. Reports newly installed transitive packages, resolved version moves with breaking risk, a registry that changed, and the most serious finding available here: the same version with a different integrity hash, meaning the artifact behind a version that was supposed to be immutable is not the one that was there before.",
  "type": "http",
  "serviceName": "Lockfile Change Report",
  "resourceType": "Security",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "180000",
      "amountUsd": 0.18,
      "maxTimeoutSeconds": 60
    }
  ],
  "outputSchema": {
    "properties": {
      "example": {
        "type": "object"
      },
      "type": {
        "type": "string"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "after": {
              "lockfileVersion": 3,
              "packages": {
                "": {
                  "name": "orders-api",
                  "version": "2.2.0"
                },
                "node_modules/cookie": {
                  "integrity": "sha512-TAMPERED",
                  "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
                  "version": "0.5.0"
                },
                "node_modules/express": {
                  "integrity": "sha512-DDDD",
                  "resolved": "https://registry.npmjs.org/express/-/express-5.0.0.tgz",
                  "version": "5.0.0"
                },
                "node_modules/router": {
                  "integrity": "sha512-EEEE",
                  "resolved": "https://packages.internal.example/router/-/router-2.0.0.tgz",
                  "version": "2.0.0"
                }
              }
            },
            "before": {
              "lockfileVersion": 3,
              "packages": {
                "": {
                  "name": "orders-api",
                  "version": "2.1.0"
                },
                "node_modules/cookie": {
                  "integrity": "sha512-BBBB",
                  "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
                  "version": "0.5.0"
                },
                "node_modules/dropped": {
                  "integrity": "sha512-CCCC",
                  "resolved": "https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz",
                  "version": "1.0.0"
                },
                "node_modules/express": {
                  "integrity": "sha512-AAAA",
                  "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
                  "version": "4.18.2"
                }
              }
            },
            "expected_registry": "https://registry.npmjs.org/"
          },
          "bodyType": "json",
          "method": "POST",
          "type": "http"
        },
        "output": {
          "example": {
            "added_count": 1,
            "after_lockfile_version": 3,
            "after_package_count": 3,
            "assumptions": [
              "Packages are keyed by name taken from the install path, so one package appearing at two paths is compared once.",
              "The same version with a different integrity hash means the published artifact changed under a version that was supposed to be immutable, which is reported as the most serious finding available here.",
              "A newly installed transitive package is reported even though no manifest changed, because that is what a lockfile diff exists to show."
            ],
            "before_lockfile_version": 3,
            "before_package_count": 3,
            "changed_count": 1,
            "changes": [
              {
                "from": "1.0.0",
                "kind": "removed",
                "name": "dropped",
                "to": null
              },
              {
                "dev": false,
                "from": "4.18.2",
                "kind": "major",
                "name": "express",
                "potentially_breaking": true,
                "to": "5.0.0"
              },
              {
                "dev": false,
                "from": null,
                "kind": "added",
                "name": "router",
                "to": "2.0.0"
              }
            ],
            "complete": true,
            "finding_count": 3,
            "findings": [
              {
                "code": "POTENTIALLY_BREAKING_RESOLUTION",
                "dependency": "express",
                "detail": "express resolved from 4.18.2 to 5.0.0, a major change."
              },
              {
                "code": "INTEGRITY_CHANGED_WITHOUT_VERSION",
                "dependency": "cookie",
                "detail": "cookie is still 0.5.0 but its integrity hash changed, so the artifact behind an immutable version is not the one that was there before."
              },
              {
                "code": "PACKAGE_ADDED",
                "dependency": "router",
                "detail": "router at 2.0.0 is newly installed."
              }
            ],
            "findings_by_code": {
              "INTEGRITY_CHANGED_WITHOUT_VERSION": 1,
              "PACKAGE_ADDED": 1,
              "POTENTIALLY_BREAKING_RESOLUTION": 1
            },
            "integrity_change_count": 1,
            "limitations": [
              "Lockfile comparison only. No registry is contacted, no integrity hash is verified against an artifact, and no advisory database is consulted, so this is not a vulnerability or supply-chain attestation...",
              "unchanged is true only when both lockfiles were fully read and nothing moved."
            ],
            "limits": {
              "maxComponents": 5000,
              "maxDependencies": 5000,
              "maxFindings": 500,
              "maxJobs": 200,
              "maxResources": 2000,
              "maxServices": 200,
              "maxVariables": 1000
            },
            "not_examined": [],
            "observed_at": "2026-10-02T00:00:00.000Z",
            "passed": false,
            "potentially_breaking_count": 1,
            "registry_change_count": 0,
            "removed_count": 1,
            "request_id": "example-request",
            "service_id": "lockfile_change_report",
            "service_version": "1.0.0",
            "unchanged": false
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "additionalProperties": false,
                "properties": {
                  "after": {
                    "type": "object"
                  },
                  "before": {
                    "type": "object"
                  },
                  "expected_registry": {
                    "maxLength": 256,
                    "type": "string"
                  }
                },
                "required": [
                  "before",
                  "after"
                ],
                "type": "object"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "lockfile",
    "supply chain",
    "dependencies",
    "diff",
    "release safety",
    "bazaar"
  ],
  "sourceHost": "api.zfinia.com",
  "lastUpdated": "2026-10-04T08:04:45.009Z",
  "quality": {
    "calls30d": 1,
    "uniquePayers30d": 1,
    "lastCalledAt": "2026-10-04T08:04:40.554Z"
  },
  "metadata": {
    "serviceName": "Lockfile Change Report",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "after": {
                "lockfileVersion": 3,
                "packages": {
                  "": {
                    "name": "orders-api",
                    "version": "2.2.0"
                  },
                  "node_modules/cookie": {
                    "integrity": "sha512-TAMPERED",
                    "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
                    "version": "0.5.0"
                  },
                  "node_modules/express": {
                    "integrity": "sha512-DDDD",
                    "resolved": "https://registry.npmjs.org/express/-/express-5.0.0.tgz",
                    "version": "5.0.0"
                  },
                  "node_modules/router": {
                    "integrity": "sha512-EEEE",
                    "resolved": "https://packages.internal.example/router/-/router-2.0.0.tgz",
                    "version": "2.0.0"
                  }
                }
              },
              "before": {
                "lockfileVersion": 3,
                "packages": {
                  "": {
                    "name": "orders-api",
                    "version": "2.1.0"
                  },
                  "node_modules/cookie": {
                    "integrity": "sha512-BBBB",
                    "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
                    "version": "0.5.0"
                  },
                  "node_modules/dropped": {
                    "integrity": "sha512-CCCC",
                    "resolved": "https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz",
                    "version": "1.0.0"
                  },
                  "node_modules/express": {
                    "integrity": "sha512-AAAA",
                    "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
                    "version": "4.18.2"
                  }
                }
              },
              "expected_registry": "https://registry.npmjs.org/"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "added_count": 1,
              "after_lockfile_version": 3,
              "after_package_count": 3,
              "assumptions": [
                "Packages are keyed by name taken from the install path, so one package appearing at two paths is compared once.",
                "The same version with a different integrity hash means the published artifact changed under a version that was supposed to be immutable, which is reported as the most serious finding available here.",
                "A newly installed transitive package is reported even though no manifest changed, because that is what a lockfile diff exists to show."
              ],
              "before_lockfile_version": 3,
              "before_package_count": 3,
              "changed_count": 1,
              "changes": [
                {
                  "from": "1.0.0",
                  "kind": "removed",
                  "name": "dropped",
                  "to": null
                },
                {
                  "dev": false,
                  "from": "4.18.2",
                  "kind": "major",
                  "name": "express",
                  "potentially_breaking": true,
                  "to": "5.0.0"
                },
                {
                  "dev": false,
                  "from": null,
                  "kind": "added",
                  "name": "router",
                  "to": "2.0.0"
                }
              ],
              "complete": true,
              "finding_count": 3,
              "findings": [
                {
                  "code": "POTENTIALLY_BREAKING_RESOLUTION",
                  "dependency": "express",
                  "detail": "express resolved from 4.18.2 to 5.0.0, a major change."
                },
                {
                  "code": "INTEGRITY_CHANGED_WITHOUT_VERSION",
                  "dependency": "cookie",
                  "detail": "cookie is still 0.5.0 but its integrity hash changed, so the artifact behind an immutable version is not the one that was there before."
                },
                {
                  "code": "PACKAGE_ADDED",
                  "dependency": "router",
                  "detail": "router at 2.0.0 is newly installed."
                }
              ],
              "findings_by_code": {
                "INTEGRITY_CHANGED_WITHOUT_VERSION": 1,
                "PACKAGE_ADDED": 1,
                "POTENTIALLY_BREAKING_RESOLUTION": 1
              },
              "integrity_change_count": 1,
              "limitations": [
                "Lockfile comparison only. No registry is contacted, no integrity hash is verified against an artifact, and no advisory database is consulted, so this is not a vulnerability or supply-chain attestation...",
                "unchanged is true only when both lockfiles were fully read and nothing moved."
              ],
              "limits": {
                "maxComponents": 5000,
                "maxDependencies": 5000,
                "maxFindings": 500,
                "maxJobs": 200,
                "maxResources": 2000,
                "maxServices": 200,
                "maxVariables": 1000
              },
              "not_examined": [],
              "observed_at": "2026-10-02T00:00:00.000Z",
              "passed": false,
              "potentially_breaking_count": 1,
              "registry_change_count": 0,
              "removed_count": 1,
              "request_id": "example-request",
              "service_id": "lockfile_change_report",
              "service_version": "1.0.0",
              "unchanged": false
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "after": {
                      "type": "object"
                    },
                    "before": {
                      "type": "object"
                    },
                    "expected_registry": {
                      "maxLength": 256,
                      "type": "string"
                    }
                  },
                  "required": [
                    "before",
                    "after"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "api.zfinia.com",
    "manifest_name": "api.zfinia.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-14T01:15:01.050Z"
  },
  "exampleResponse": {
    "added_count": 1,
    "after_lockfile_version": 3,
    "after_package_count": 3,
    "assumptions": [
      "Packages are keyed by name taken from the install path, so one package appearing at two paths is compared once.",
      "The same version with a different integrity hash means the published artifact changed under a version that was supposed to be immutable, which is reported as the most serious finding available here.",
      "A newly installed transitive package is reported even though no manifest changed, because that is what a lockfile diff exists to show."
    ],
    "before_lockfile_version": 3,
    "before_package_count": 3,
    "changed_count": 1,
    "changes": [
      {
        "from": "1.0.0",
        "kind": "removed",
        "name": "dropped",
        "to": null
      },
      {
        "dev": false,
        "from": "4.18.2",
        "kind": "major",
        "name": "express",
        "potentially_breaking": true,
        "to": "5.0.0"
      },
      {
        "dev": false,
        "from": null,
        "kind": "added",
        "name": "router",
        "to": "2.0.0"
      }
    ],
    "complete": true,
    "finding_count": 3,
    "findings": [
      {
        "code": "POTENTIALLY_BREAKING_RESOLUTION",
        "dependency": "express",
        "detail": "express resolved from 4.18.2 to 5.0.0, a major change."
      },
      {
        "code": "INTEGRITY_CHANGED_WITHOUT_VERSION",
        "dependency": "cookie",
        "detail": "cookie is still 0.5.0 but its integrity hash changed, so the artifact behind an immutable version is not the one that was there before."
      },
      {
        "code": "PACKAGE_ADDED",
        "dependency": "router",
        "detail": "router at 2.0.0 is newly installed."
      }
    ],
    "findings_by_code": {
      "INTEGRITY_CHANGED_WITHOUT_VERSION": 1,
      "PACKAGE_ADDED": 1,
      "POTENTIALLY_BREAKING_RESOLUTION": 1
    },
    "integrity_change_count": 1,
    "limitations": [
      "Lockfile comparison only. No registry is contacted, no integrity hash is verified against an artifact, and no advisory database is consulted, so this is not a vulnerability or supply-chain attestation...",
      "unchanged is true only when both lockfiles were fully read and nothing moved."
    ],
    "limits": {
      "maxComponents": 5000,
      "maxDependencies": 5000,
      "maxFindings": 500,
      "maxJobs": 200,
      "maxResources": 2000,
      "maxServices": 200,
      "maxVariables": 1000
    },
    "not_examined": [],
    "observed_at": "2026-10-02T00:00:00.000Z",
    "passed": false,
    "potentially_breaking_count": 1,
    "registry_change_count": 0,
    "removed_count": 1,
    "request_id": "example-request",
    "service_id": "lockfile_change_report",
    "service_version": "1.0.0",
    "unchanged": false
  }
}