Tools · dev

npm / PyPI package safety and maintenance

Is an npm or PyPI package version safe and maintained? Known vulnerabilities from OSV.dev (ids, CVEs, the advisory's own severity, fixed versions), deprecation or yank, licence, repository, publish dates, latest version, weekly downloads, dependency and maintainer counts, stated risk flags. No code scanning; unknowns are null. An unknown package or an outage is not charged. Pay-per-call via x402.

Inputs

Example

Request body

{"name":"lodash","ecosystem":"npm","version":"4.17.20"}

Answer (the published example)

{"ecosystem":"npm","name":"lodash","version":"4.17.20","latestVersion":"4.18.1","isLatest":false,"description":"Lodash modular utilities.","license":"MIT","repository":"https://github.com/lodash/lodash","homepage":"https://lodash.com/","deprecated":null,"publishedAt":"2020-08-13T16:53:54.152Z","latestPublishedAt":"2026-04-01T21:01:20.458Z","daysSinceLatestRelease":189,"downloadsLastWeek":203122461,"dependencyCount":0,"maintainersCount":1,"vulnerabilities":[{"id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-r5fr-rjxr-66jc"],"summary":"Command Injection in lodash","severity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","fixedIn":["4.17.21"],"published":"2021-05-06T16:05:51.000Z","url":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"},{"id":"GHSA-r5fr-rjxr-66jc","aliases":["CVE-2021-23337","CVE-2026-4800","GHSA-35jh-r3h4-6jhm"],"summary":"lodash vulnerable to Code Injection via `_.template` imports key names","severity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","fixedIn":["4.18.0"],"published":"2026-04-01T23:51:12.000Z","url":"https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"},{"id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","severity":"MODERATE","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","fixedIn":["4.17.21"],"published":"2022-01-06T20:30:46.000Z","url":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"},{"id":"GHSA-f23m-r3pf-42rh","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-xxjr-mmjv-4gpg"],"summary":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","severity":"MODERATE","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","fixedIn":["4.18.0"],"published":"2026-04-01T23:50:27.000Z","url":"https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh"},{"id":"GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465","CVE-2026-2950","GHSA-f23m-r3pf-42rh"],"summary":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","severity":"MODERATE","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","fixedIn":["4.17.23"],"published":"2026-01-21T23:01:22.000Z","url":"https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg"}],"vulnerabilityCount":5,"osvRecords":5,"riskFlags":["known_vulnerabilities","high_or_critical_vulnerability","newer_version_available"],"source":"npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev","asOf":"2026-10-08T16:18:31.547Z","note":"Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0)."}

Call it

curl

# 1) ask: an unpaid call answers 402 with the exact price (free)
curl -i -X POST https://fiatdock.com/v1/dev/package -H 'content-type: application/json' -d '{"name":"lodash","ecosystem":"npm","version":"4.17.20"}'
# 2) pay: any x402 client signs that 402 and resends — see Node or Python below

Node

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const pay = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: "eip155:*", client: new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_PRIVATE_KEY)) }],
});
const r = await pay("https://fiatdock.com/v1/dev/package", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"name":"lodash","ecosystem":"npm","version":"4.17.20"}),
});
console.log(r.status, await r.json());

Python

# pip install "x402[httpx,evm]"
import asyncio, json, os
from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm.exact import register_exact_evm_client

async def main():
    client = register_exact_evm_client(x402Client(), Account.from_key(os.environ["AGENT_PRIVATE_KEY"]))
    async with x402HttpxClient(client) as http:
        r = await http.post("https://fiatdock.com/v1/dev/package", json=json.loads("{\"name\":\"lodash\",\"ecosystem\":\"npm\",\"version\":\"4.17.20\"}"))
        print(r.status_code, r.json())

asyncio.run(main())

MCP (Claude, Cursor, any MCP client)

{"mcpServers":{"fiatdock":{"command":"npx","args":["-y","fiatdock-mcp"],"env":{"AGENT_PRIVATE_KEY":"0x<your agent wallet key>"}}}}
// then call the tool "package_intel" — the package pays each call from that wallet

The wallet needs USDC on Base. Prefer no install? The remote server https://fiatdock.com/mcp answers the 402 as tool output for an agent that signs its own payments.

Machine-readable: OpenAPI · tools.json · llms.txt · /.well-known/x402