mirrored listing x402 eip155:8453solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp

Security and provenance for an open-source package, composed live from three authoritative

Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."

5400 (raw units)

price

calls / 30d

unique payers

2026-09-11

updated

Provider

2s.io · discovered, not yet claimed by its owner

Payment (x402 accepts[])

[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "5400",
    "maxTimeoutSeconds": 60
  },
  {
    "scheme": "exact",
    "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
    "payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
    "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
    "amount": "5400",
    "maxTimeoutSeconds": 60
  }
]

Output schema

{
  "bazaar": {
    "info": {
      "input": {
        "method": "GET",
        "queryParams": {
          "ecosystem": "npm",
          "name": "lodash",
          "version": "4.17.20"
        },
        "type": "http"
      }
    },
    "schema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "properties": {
        "input": {
          "properties": {
            "method": {
              "const": "GET"
            },
            "queryParams": {
              "properties": {
                "ecosystem": {
                  "description": "Package ecosystem: npm, pypi, go, maven, cargo, or nuget.",
                  "type": "string"
                },
                "name": {
                  "description": "Package name (e.g. lodash, requests).",
                  "type": "string"
                },
                "version": {
                  "description": "Version (defaults to latest).",
                  "type": "string"
                }
              },
              "required": [
                "ecosystem",
                "name"
              ]
            },
            "type": {
              "const": "http"
            }
          },
          "required": [
            "type",
            "method",
            "queryParams"
          ],
          "type": "object"
        }
      },
      "required": [
        "input"
      ],
      "type": "object"
    }
  }
}

Use it

curl

curl "https://2s.io/api/security/package"
# -> 402 Payment Required, accepts[] lists how to pay
# retry with a PAYMENT-SIGNATURE (or PAYMENT header) once paid

JavaScript

const res = await fetch("https://2s.io/api/security/package");
if (res.status === 402) {
  const { accepts } = await res.json();
  // pay one of accepts[] via an x402 client, then retry with the payment header
}

Python

import httpx
res = httpx.get("https://2s.io/api/security/package")
if res.status_code == 402:
    accepts = res.json()["accepts"]
    # pay one of accepts[] via an x402 client, then retry with the payment header

Machine-readable

Everything on this page is also available as clean JSON at /resources/6650.json, and this resource appears in /discovery/resources and /discovery/search.