Paid services on Base matching “package”

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoi

Takes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, the digest length is checked against the declared algorithm before anything is fetched, and the response names every matching package version, since one artefact

Is this WordPress plugin, npm package or PyPI project abandoned? Status, 0-100 abandonment-risk score, months since last update, and the signals behind it.

Deterministic npm package evidence: registry facts, distribution integrity, provenance, and factual flags for coding agents.

Given a company website domain, returns a compact company card: the business name and the page element it came from, a generic role contact address (info@, sales@, support@ ...) only if the site publishes one, never a personal address, and the names of up to 10 technology platforms the site runs. Same scrape and evidence check as /scrape, without the evidence detail, at half the price. Free prompt

Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.

Google deps.dev / Open Source Insights package metadata (keyless). POST {system, name|package}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Disclose adjacency: packagist-package / nuget-package / osv-vuln-query / openssf-scorecard (≠ those products; deps.dev supply-chain lane).

Composer/Packagist package metadata p2 (keyless). POST {vendor}/{package}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. PHP package registry lane (≠ npm/pypi/crates).

NuGet (.NET) package versions via flat container (keyless). POST {id|package}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Disclose adjacency: packagist-package / crates-io-lookup / rubygems-lookup (≠ those registries; .NET NuGet lane).

NPM package info API: package registry lookup for npm, PyPI and Cargo with latest version, age, license, deprecation, weekly downloads and OSV vulnerabilities. Dependency check before install.

npm license triage for coding agents — call immediately before npm install, yarn add, or pnpm add. Returns npm-declared license, SPDX id, and permissive-default compatible (yes | no | unknown) so the agent can proceed, swap package, or escalate. Not SBOM, not legal advice. Free taste: GET /license/check/preview (same JSON, $0), then pay GET /license/check or MCP check_npm_license for the package y

PyPI breaking changes between two versions of a Python package, before a pip package upgrade: the documented breaking changes per version from the project's CHANGELOG, HISTORY or CHANGES file and GitHub release notes (alpha/beta/rc folded into the major), plus Requires-Python and required dependency changes, yanked versions, migration guide links and a verdict. PEP 440 versions ('1.10.13', '2.0')

Audit a whole dependency manifest in one call before installing or upgrading. Send a package.json, a requirements.txt, or npm and PyPI package lists (up to 50 packages). Per dependency: latest version and publish date, whether your pin is behind, license, deprecation or yanked status, weekly npm downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no

Check an open-source package for known vulnerabilities via the OSV database (Google Open Source Vulnerabilities). Pass package name, ecosystem (npm, PyPI, Go, crates.io, Maven, RubyGems, etc.) and optional version. Returns vulnerability IDs, summaries, severity and fixed versions. Essential pre-install check for coding agents.

Check an exact npm or PyPI package version immediately before installation using current registry, vulnerability, malicious-package, withdrawal/deprecation, and verified provenance evidence. Returns ALLOW, REVIEW, BLOCK, or UNKNOWN with machine-readable reasons.

Check an npm package, PyPI package, or GitHub repo and return a DepScout install verdict.

Pre-install scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill, MCP server or tool list, or inline content. Matches OSV and OpenSSF malicious-package advisories, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and MCP tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 of the input and an Ed25519-si

Foojay Disco JDK package discovery (keyless). POST {version?, distribution?, package_type?, operating_systems?, architectures?}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Soft disclose adoptium-releases / endoflife-product (≠ Adoptium thin twin; Java Disco lane).

Anitya / release-monitoring package versions (keyless). POST {name|project|q,limit?}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Soft disclose dockerhub / package-registry / foojay / deps-dev / endoflife.

New vulnerabilities in one place: CISA Known Exploited Vulnerabilities from the last 14 days (due dates, ransomware use), CVEs published in the last 24 hours (CVSS, severity, CWE, vendor/product), and reviewed GitHub advisories (ecosystem, package, vulnerable and patched versions). Rebuilt every hour. $0.01 per call, no account. Free 24h-delayed sample: GET https://ioswarm.io/api/v1/feeds/security

For one DailyMed SET ID: the current label version and date, its products with active ingredients and package descriptions, its marketed NDC codes, and the full revision history.

Android app details by package name (e.g. com.whatsapp): title, developer, description, what's new, screenshots, icon, rating, installs, category, tags, price, required Android version, Editors' Choice, latest version and APK download availability. Google Play app metadata in one JSON record, for app research, app-store intelligence and catalog enrichment. Keyless pay-per-call in USDC on Base or S

Ranks edit-distance proximity between a candidate name and supplied popular package names. Missing facts are returned as null and named in unavailable_fields where applicable. Derived values disclose their method; source-backed values disclose source, time window and age.

Complete structured package for one illustrated classic of early science/engineering (1588-1748): verified public-domain scan, full metadata, curated description, full-text OCR link, IIIF manifest, and page-image URL template. Works: Ramelli machines 1588, Agricola De re metallica 1621, Hooke Micrographia 1665, Newton Principia 1687 & Opticks 1730, Euler Introductio 1748. Param: ?id=<work_id>

CVE fact check, deterministic. Answers "is CVE-XXXX-NNNN real", "is it exploited in the wild", "what version fixes it", "how severe is it". Joins the NVD record (CVSS score, vector, dates), the CISA KEV catalog (actively-exploited flag, remediation due date, ransomware use), and OSV (affected packages + fixed versions per ecosystem). No LLM. Distinguishes "not a known CVE" from "registry unreachab

Semiconductor intelligence API for agents. Covers fab capacity, foundries, GPU shipments, advanced packaging, export controls, chip manufacturing, and supply-chain disruptions. Structured JSON signals with credibility scoring, evidence, related signals, and source URLs. Pay-per-request via x402 on Base Mainnet; free discovery available.

Scan up to 50 open-source packages (ecosystem, name, version) against OSV.dev: advisory ids, summary, severity, CVSS, fixed versions, CVE aliases with CISA KEV and EPSS joined, and a suggested minimum safe version.

Package vulnerability check — check one exact open-source dependency version or purl against OSV, enrich CVE matches with CISA KEV known-exploited signals, and report fixes, severity, and provenance.

Repair one x402 route's Bazaar discovery metadata in one call. Send a resource URL and one real sample output; get the defect report plus a complete discovery package — full output schema inferred from the sample, a sub-500-char description with a use-when sentence, OpenAPI and well-known snippets, paste-in instructions — that ships only after passing both x402 SDK validators. Use this when your l

Package security scanner — CVEs, license check, typosquat detection.