All projects on Base matching “npm”

Typosquat and quality signals for an npm package before installing it: weekly downloads, latest version, license, deprecation notice, repository link, and computed risk flags (low_downloads, deprecated, no_repository, no_license, not_found). A package with 12 weekly downloads pretending to be a popular library is the classic supply-chain attack on coding agents. Pairs with the package-vulns endpoi

PyPI breaking changes between two versions of a Python package, before a pip package upgrade: the documented breaking changes per version from the project's CHANGELOG, HISTORY or CHANGES file and GitHub release notes (alpha/beta/rc folded into the major), plus Requires-Python and required dependency changes, yanked versions, migration guide links and a verdict. PEP 440 versions ('1.10.13', '2.0')

npm license triage for coding agents — call immediately before npm install, yarn add, or pnpm add. Returns npm-declared license, SPDX id, and permissive-default compatible (yes | no | unknown) so the agent can proceed, swap package, or escalate. Not SBOM, not legal advice. Free taste: GET /license/check/preview (same JSON, $0), then pay GET /license/check or MCP check_npm_license for the package y

NPM package info API: package registry lookup for npm, PyPI and Cargo with latest version, age, license, deprecation, weekly downloads and OSV vulnerabilities. Dependency check before install.

Audit a whole dependency manifest in one call before installing or upgrading. Send a package.json, a requirements.txt, or npm and PyPI package lists (up to 50 packages). Per dependency: latest version and publish date, whether your pin is behind, license, deprecation or yanked status, weekly npm downloads, and known vulnerabilities from OSV with severity and first fixed version. Deterministic, no

Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.

npm package safety gate: vulnerabilities, malware advisories, typosquatting, install-script risk.

11-source parallel intelligence report in one call — HN, GitHub, npm, PyPI, Dev.to, Hashnode, Lobsters, StackExchange, ArXiv, Semantic Scholar, GitLab. Best ROI on Bazaar. AI agent API for market research. Accepts USDC payments on Base and Solana

Check an open-source package for known vulnerabilities via the OSV database (Google Open Source Vulnerabilities). Pass package name, ecosystem (npm, PyPI, Go, crates.io, Maven, RubyGems, etc.) and optional version. Returns vulnerability IDs, summaries, severity and fixed versions. Essential pre-install check for coding agents.

Check an exact npm or PyPI package version immediately before installation using current registry, vulnerability, malicious-package, withdrawal/deprecation, and verified provenance evidence. Returns ALLOW, REVIEW, BLOCK, or UNKNOWN with machine-readable reasons.

Is this WordPress plugin, npm package or PyPI project abandoned? Status, 0-100 abandonment-risk score, months since last update, and the signals behind it.

Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.

Call before installing or updating an npm or PyPI dependency. Returns a verdict (ok, caution, avoid, unknown) plus evidence signals: install script added, maintainer or publisher change, very recent publish, build provenance dropped, known malware and vulnerability advisories. A clean result is not a guarantee of safety.

Checks whether an npm, PyPI, or crates.io package is safe to install: confirms it exists, flags malicious or typosquatted/slopsquatted names, checks known CVEs (OSV.dev), and pulls its OpenSSF Scorecard. Returns an ALLOW/WARN/BLOCK verdict before your agent installs it.

Full audit: Semgrep + ESLint + Bandit + npm audit (if packageJson provided).

Returns a per-day download time series for an npm package over a period from keyless api.npmjs.org — the raw signal for trend and growth-rate detection. Lets autonomous agents compute momentum/decline and feed agent-to-agent dependency-selection scoring. Ranking surface for trajectory. First call FREE per wallet — send header X-WALLET: 0x<addr>. No charge on upstream failure.

Advanced startup name check: domains across 13 TLDs, GitHub, npm, PyPI, X, YouTube and Instagram handles, available .com name variants, notable Wikidata name collisions, plus ready-to-call links for App Store, Google search and EU trademark checks.

Check an npm package, PyPI package, or GitHub repo and return a DepScout install verdict.

Pre-install scan of an npm or PyPI package, GitHub repo, raw URL, ClawHub skill, MCP server or tool list, or inline content. Matches OSV and OpenSSF malicious-package advisories, then behavioral analysis for credential theft, exfiltration, obfuscation, prompt injection, install-time droppers and MCP tool poisoning. Returns a verdict, file-and-line evidence, a SHA-256 of the input and an Ed25519-si

Fast text-to-image with Flux 1 Schnell (@cf/black-forest-labs/flux-1-schnell). POST prompt and optional dimensions; returns base64 image output. Hero: GET /heroes/flux-schnell. Per-generation x402 pricing per USDC per request (see npm run pricing:report).

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Verify the current stable npm or PyPI package release and check a version/date claim against canonical registry metadata.

Deterministic npm package evidence: registry facts, distribution integrity, provenance, and factual flags for coding agents.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions. (https://cve-intel.agentdiet.dev/v1/cve-intel)

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev) (/v1/cve-intel) — Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and returns active CVEs, GHSA advisories, and patched versions.

Use this before adding or upgrading an npm dependency (OpenZeppelin, solmate, hardhat…), or to triage a lockfile: GitHub/OSV advisories affecting a whole package-lock.json or yarn.lock (or up to 100 listed packages) at their exact pinned versions. Instant, per request.

Call before publishing a claim that cites EU law. Checks that the cited instrument exists in our pinned corpus, that the cited article exists within it, and whether your quoted text actually appears in that article. Covers the AI Act, GDPR, NIS2, DORA and the Cyber Resilience Act. Returns the official article text with a EUR-Lex link. Citation verification only: it never gives legal advice or clas

Use before spending tokens, money or crawler capacity fetching an unfamiliar web resource. Resolves redirects (manually, bounded, re-validated per hop) and returns deterministic HTTP/resource facts — final URL, status, content type and length, response time, a bounded HTML title/canonical peek, and a lightweight generic-bot robots.txt indication — so an agent can decide whether a normal web fetch