Name: package-risk-npm
Price: 0.03 USDC
Availability: InStock

$ man package-risk-npm

agentutility / prooflayer / package-risk-npm

PRICE / CALL

$0.03

USDC · base mainnet · scheme: exact

METHOD

POST

CLUSTER

prooflayer

CATEGORY

STATUS

● live

NAME

package-risk-npm — npm package risk score / supply-chain scanner / typosquat detector

SYNOPSIS

POST https://x402.org/v1/package-risk-npm
     Content-Type: application/json
     X-PAYMENT:    <signed-transferWithAuthorization>

     { ... }

↳ first call → 402 Payment Required. Sign USDCtransferWithAuthorization, retry with theX-PAYMENT header.

DESCRIPTION

npm package risk score / supply-chain scanner / typosquat detector. Maintainer count, weekly downloads, install scripts, dependency depth, deprecation, age, typosquat distance to popular packages. Plus LLM risk summary.

INPUT — request schema

property	type	description	req?
package_name	string	e.g. 'lodash' or '@scope/name'.	required
version	string	Optional specific version (e.g. '4.17.21'). Default: latest tagged version.	optional

OUTPUT — response shape

field	type	description
package_name	string	npm package name that was scanned.
version	string	Specific package version evaluated, or latest if no version was requested.
score	number	Numeric risk score (higher = riskier) aggregated from maintainer, download, install-script, and typosquat signals.
risk_level	string	Categorical bucket like low, medium, high, or critical derived from the score.
summary	string	LLM-written plain-English risk summary covering the main red flags for this package.
signals	object	Raw signal breakdown: maintainer count, weekly downloads, install scripts, dep depth, deprecation, age, typosquat distance.
metadata	object	Package metadata from the npm registry: publish date, license, repo URL, homepage, latest version, deprecation status.

EXAMPLES — two ways to call

EXAMPLE 1 · curl

curl -X POST https://x402.org/v1/package-risk-npm \
  -H 'Content-Type: application/json' \
  -d '{ }'

first response = 402 Payment Required with payment requirements; sign + retry with X-PAYMENT.

EXAMPLE 2 · mcp

# install once
claude mcp add x402 --command "npx x402-deployer-mcp"

# then ask Claude Code:
# "use the package-risk-npm tool to ..."

MCP server handles payment automatically — your coding agent just calls the tool by name.

METADATA

tags: npmsupply-chainsecuritypackagerisk
env: VENICE_API_KEY
methods: POST
cluster: prooflayer
price: $0.03 USDC per call

ADJACENT — other endpoints in prooflayer

endpoint	description	price
ai-content-detector	AI content detector / GPT detector / ChatGPT plagiarism checker.	$0.03
dep-risk-summary	repo dependency risk audit / package.json + lockfile vetter / unpinned dep detector / transitive dep counter / requirements.txt audit / p…	$0.03
github-repo-health	GitHub repo health score / open-source maintainability checker.	$0.03
prompt-injection-surface	AI prompt injection surface scanner / LLM call-site audit / unsanitized user input in prompts detector / system-message mixing flag / unb…	$0.03
db-migration-risk	DB migration risk audit / SQL migration safety check / DROP COLUMN detector / unsafe ALTER TABLE detector / Postgres CREATE INDEX CONCURR…	$0.02
deploy-config-risk	deploy config audit / Dockerfile lint / vercel.json hardening / wrangler.toml review / docker-compose.yml safety / fly.toml secrets check…	$0.02
secrets-exposure-check	secrets exposure scan / hardcoded API key detector / .env-committed-key audit / Next.js client env leak detector / pre-deploy secret gate.	$0.02
pypi-package-risk	PyPI package risk score / Python supply-chain scanner.	$0.01

/package-risk-npm(1)