{
  "x402Version": 2,
  "id": 6650,
  "slug": "6650",
  "resource": "https://2s.io/api/security/package",
  "description": "Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers \"is this dependency safe to add, what license does it carry, and how well-maintained is it.\"",
  "type": "http",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "5400",
      "maxTimeoutSeconds": 60
    },
    {
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "amount": "5400",
      "maxTimeoutSeconds": 60
    }
  ],
  "outputSchema": {
    "bazaar": {
      "info": {
        "input": {
          "method": "GET",
          "queryParams": {
            "ecosystem": "npm",
            "name": "lodash",
            "version": "4.17.20"
          },
          "type": "http"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "properties": {
              "method": {
                "const": "GET"
              },
              "queryParams": {
                "properties": {
                  "ecosystem": {
                    "description": "Package ecosystem: npm, pypi, go, maven, cargo, or nuget.",
                    "type": "string"
                  },
                  "name": {
                    "description": "Package name (e.g. lodash, requests).",
                    "type": "string"
                  },
                  "version": {
                    "description": "Version (defaults to latest).",
                    "type": "string"
                  }
                },
                "required": [
                  "ecosystem",
                  "name"
                ]
              },
              "type": {
                "const": "http"
              }
            },
            "required": [
              "type",
              "method",
              "queryParams"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "2s.io",
  "lastUpdated": "2026-09-11T10:42:10.943Z",
  "quality": {
    "calls30d": 2,
    "uniquePayers30d": 1,
    "lastCalledAt": "2026-09-11T10:42:10.76Z"
  },
  "liveness": {},
  "verified": false,
  "featured": false,
  "provider": {
    "host": "2s.io",
    "manifest_name": "2s.io",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-09-18T22:00:31.484Z"
  }
}