All projects on Base matching “packages”

Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.

Checks whether an npm, PyPI, or crates.io package is safe to install: confirms it exists, flags malicious or typosquatted/slopsquatted names, checks known CVEs (OSV.dev), and pulls its OpenSSF Scorecard. Returns an ALLOW/WARN/BLOCK verdict before your agent installs it.

Full-text search of published British Columbia FOI release packages.

Returns a per-day download time series for an npm package over a period from keyless api.npmjs.org — the raw signal for trend and growth-rate detection. Lets autonomous agents compute momentum/decline and feed agent-to-agent dependency-selection scoring. Ranking surface for trajectory. First call FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.

DeAI artifact gateway: reuse (package_check). Deterministic JSON with byte-exact quotes for $0.0100; no crawl, no bot walls.

Search for packaged food products by name, brand, category, barcode, or ingredient.

HDX Humdata CKAN package_search (keyless). POST {q}/{rows?}. Empty -> 400 not charged. fema/gdacs/eonet adjacency disclosed.

npm / PyPI package metadata (keyless). Ecosystem + name → latest version, license, homepage.

OSV.dev vulnerability query (keyless). POST {package:{name,ecosystem},version?}/{commit?}. Empty -> 400 not charged. nist-nvd-cve-lookup adjacency. Native POST api.osv.dev/v1/query (GET 405).

Docker Hub image/repo metadata (keyless). POST {name|image|namespace+repository}. Unpaid empty → 402; after settle empty/invalid → 400 charged:false. Soft disclose package-registry / foojay / crates / nuget / deps-dev / endoflife.

Use when you have a likely PyPI project name (or a few tokens) and need to resolve it to live projects: tries the query as-is, PEP 503 normalization (lowercase, [-_.] → -), and hyphen/underscore/dot variants, then returns up to "limit" matching projects with summary, version, requires_python and license. This is name resolution, not full-text discovery — prefer exact package names when known. Auth

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (https://cve-intel.agentdiet.dev/v1/cve-intel)

Multi-carrier package tracking. Live: FedEx, USPS, DHL. In rollout: UPS. Roadmap (returns 'coming soon' to log demand): Canada Post, La Poste, Royal Mail, Australia Post, Evri, Deutsche Post, PostNL, China Post, Japan Post, India Post, Correos, Poste Italiane, Aramex, Yodel, Swiss Post, Correios BR, EMS, OnTrac, Amazon Shipping. Pass tracking_number (and optional carrier='royal_mail' style slug).

Verify the current stable npm or PyPI package release and check a version/date claim against canonical registry metadata.

Use this before adding or upgrading an npm dependency (OpenZeppelin, solmate, hardhat…), or to triage a lockfile: GitHub/OSV advisories affecting a whole package-lock.json or yarn.lock (or up to 100 listed packages) at their exact pinned versions. Instant, per request.