Npm dependency risk x402 v1

What the provider says

Quoted from PayAI · source record · read 2026-10-26

---

Facts and where they come from

Price

0.01 USDC per call Provider claim

Recorded value: 0.01 USDC per call.

Unit

per call

Protocol

x402, REST · transport: HTTP Provider claim

Auth

x402

Endpoint

https://tkoqkknsezxavtxfywkm.supabase.co/functions/v1/npm-dependency-risk-x402-v1

Source

PayAI · Public discovery API (provider-published records)

Last checked

Not checked by us yet — the data is as the source published it

First seen

2026-10-26

Payments and earnings

No settled payment on record. Earnings for this service are unknown — not zero.

Payment rails

A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it. See evidence levels.

Input and output, as published

Request

{
    "type": "http",
    "method": "GET",
    "queryParams": {
        "package": "lodash",
        "version": "4.17.20"
    }
}

Response

{
    "type": "json",
    "example": {
        "source": [
            "npm registry (including dist.integrity/dist.shasum release metadata)",
            "npm downloads API",
            "OSV.dev",
            "FIRST EPSS API (best effort)",
            "CISA Known Exploited Vulnerabilities catalog (best effort)"
        ],
        "package": "lodash",
        "signals": [
            "known_vulnerabilities",
            "epss_score_at_or_above_0_1",
            "newer_version_available",
            "safe_upgrade_available"
        ],
        "checkedAt": "ISO-8601",
        "deprecated": false,
        "methodology": "Combines current npm metadata and release integrity fields with exact-version OSV vulnerability lookup. Fixed versions are copied from OSV fixed events for the queried npm package. CVE aliases are best-effort enriched with current FIRST EPSS probability/percentile and CISA KEV known-exploitation evidence. minimumSafeVersion is independently checked against published npm versions and exact-version OSV results. Enrichment failure does not fail the core result; not a security guarantee.",
        "maxEpssScore": 0.21,
        "latestVersion": "4.18.1",
        "releaseEvidence": {
            "basis": "npm registry release metadata",
            "latest": {
                "shasum": "...",
                "tarball": "https://registry.npmjs.org/...tgz",
                "version": "4.18.1",
                "fileCount": 0,
                "integrity": "sha512-...",
                "publishedAt": "ISO-8601",
                "unpackedSize": 0
            },
            "installed": {
                "shasum": "...",
                "tarball": "https://registry.npmjs.org/...tgz",
                "version": "4.17.20",
                "fileCount": 0,
                "integrity": "sha512-...",
                "publishedAt": "ISO-8601",
                "unpackedSize": 0
            }
        },
        "vulnerabilities": [
            {
                "id": "GHSA-...",
                "epss": [
                    {
                        "cve": "CVE-2021-23337",
                        "date": "YYYY-MM-DD",
                        "score": 0.21,
                        "percentile": 0.97
                    }
                ],
                "aliases": [
                    "CVE-2021-23337"
                ],
                "cisaKev": null,
                "cveAliases": [
                    "CVE-2021-23337"
                ],
                "fixedVersion": "4.17.21",
                "fixedVersions": [
                    "4.17.21"
                ],
                "knownExploited": false
            }
        ],
        "weeklyDownloads": 0,
        "installedVersion": "4.17.20",
        "recommendedAction": "Upgrade to minimumSafeVersion or a later compatible release after normal compatibility testing.",
        "minimumSafeVersion": "4.18.0",
        "vulnerabilityCount": 5,
        "knownExploitedCount": 0,
        "remediationPriority": "elevated",
        "weeklyDownloadsPeriod": {
            "end": "YYYY-MM-DD",
            "start": "YYYY-MM-DD"
        }
    }
}

Examples are the provider's own, not a call we made.

Provenance

One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.

Endpoint checks

We have not called this endpoint yet. Until we do, everything above is what the source published — no more.

Tags

---