pkgproof
Call before an agent runs npm install. Checks one npm package against the registry, OSV advisories, install scripts, typosquat and combosquat names and repository provenance, and flags hallucinated or slopsquatted names. Answers safe, caution, block or does_not_exist; every reason is sourced and labelled fact or heuristic.
Offering
- Provider
- x402.pkgproof.net
- Method
- POST
- Offering type
- Api Endpoint
- Transport type
- http
- Category
- Security
- Delivery
- Not provided
- Pricing model
- Not provided
- x402 version
- 2
Endpoint context
- URL
https://x402.pkgproof.net/v1/verify- MIME type
- Not provided
- First seen
- 2026-10-16T01:50:14.534Z
- Last seen
- Tags
- npm, Security, supply-chain, package-verification, typosquat
Payment pricing
x402 payment terms are the authoritative price for calling this endpoint.
- Payment option 1
- 0.05 USDC
Atomic price: 50000 · Network: eip155:8453 · Asset: USDC · Scheme: exact
Raw x402 terms
[
{
"scheme": "exact",
"network": "eip155:8453",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"amount": "50000",
"payTo": "0xB1fe0fd90C16800C3D5e811c6f07972dE9d2b98E"
}
]Observed health
- Status
- Healthy
- Latest latency
- 86 ms
- Average latency
- 465 ms
- HTTP status
- 204
- Last checked
- Reachability
- 100% over 14 checks
Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.
Input schema
{
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"ecosystem": {
"description": "npm is the only ecosystem this service verifies.",
"enum": [
"npm"
],
"type": "string"
},
"name": {
"description": "Package name. ASCII only; homoglyph and Unicode-confusable names are refused before any upstream call.",
"type": "string"
},
"version": {
"description": "Optional. Omit to verify the package rather than one release.",
"type": "string"
}
},
"required": [
"ecosystem",
"name"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
}Output schema
{
"properties": {
"example": {
"properties": {
"checked_at": {
"description": "When the verification ran, which is not always when it was requested: a reused result carries its original timestamp.",
"format": "date-time",
"type": "string"
},
"dist_tag": {
"description": "The dist-tag a version-less request resolved through; null when a version was requested.",
"type": [
"string",
"null"
]
},
"ecosystem": {
"type": "string"
},
"name": {
"type": "string"
},
"reasons": {
"description": "Evidence, one entry per finding. Branch on `code`, not on `detail`.",
"items": {
"properties": {
"code": {
"type": "string"
},
"data": {
"type": "object"
},
"detail": {
"type": "string"
},
"kind": {
"description": "fact is established; heuristic is inference and never convicts on its own.",
"enum": [
"fact",
"heuristic"
],
"type": "string"
},
"source": {
"type": "string"
},
"verdict": {
"type": "string"
}
},
"required": [
"verdict",
"code",
"kind",
"source",
"detail"
],
"type": "object"
},
"type": "array"
},
"resolved_version": {
"description": "The release the checks ran against: the requested version, or the registry's latest at the time of the check.",
"type": [
"string",
"null"
]
},
"sources": {
"description": "The upstream each check consulted, by name.",
"type": "object"
},
"verdict": {
"description": "Ordered worst-last. The overall verdict is the worst any check produced. block and does_not_exist are answers, not errors, and return 200.",
"enum": [
"safe",
"caution",
"block",
"does_not_exist"
],
"type": "string"
},
"version": {
"type": [
"string",
"null"
]
}
},
"required": [
"ecosystem",
"name",
"verdict",
"reasons",
"sources",
"checked_at"
],
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}