{"success":true,"data":{"verdict":"BLOCK","summary":{"checked":4,"allow":0,"caution":2,"block":2,"skipped":0},"packages":[{"ecosystem":"npm","name":"express","requested":"4.17.1","version":"4.17.1","version_note":null,"verdict":"CAUTION","exists":true,"reasons":[{"code":"vulnerabilities","level":"caution","detail":"0 high, 1 moderate, 0 unrated: CVE-2024-29041. Upgrade to 5.3.0 (no known vulnerabilities)."},{"code":"low_vulnerabilities","level":"info","detail":"1 low: CVE-2024-43796"}],"latest_version":"5.3.0","upgrade_to":"5.3.0","malicious":false,"vulnerabilities":{"total":2,"critical":0,"high":0,"moderate":1,"low":1,"ids":["GHSA-qw6h-vgh9-j6wx","GHSA-rv95-896h-c2vc"]},"first_published":"2010-12-29","last_release":"2026-10-09","age_days":5766,"licenses":["MIT"],"deprecated":false,"install_scripts":[],"maintainers":3,"downloads_last_week":144987450,"provenance":false,"source_repo":"github.com/expressjs/express","stars":69553,"scorecard":8.5,"url":"https://deps.dev/npm/express/4.17.1"},{"ecosystem":"npm","name":"reqeusts","requested":null,"verdict":"BLOCK","exists":false,"reasons":[{"code":"not_found","level":"block","detail":"No package \"reqeusts\" exists on npm. If an AI suggested it, the name is likely hallucinated, and attackers register such names with malware (slopsquatting). Do not install; find the real package name."}]},{"ecosystem":"pypi","name":"requests","requested":"==2.31.0","version":"2.31.0","version_note":null,"verdict":"CAUTION","exists":true,"reasons":[{"code":"vulnerabilities","level":"caution","detail":"0 high, 3 moderate, 0 unrated: CVE-2024-47081, CVE-2024-35195, CVE-2026-25645. Upgrade to 2.34.2 (no known vulnerabilities)."}],"latest_version":"2.34.2","upgrade_to":"2.34.2","malicious":false,"vulnerabilities":{"total":3,"critical":0,"high":0,"moderate":3,"low":0,"ids":["GHSA-9hjg-9r4m-mvj7","GHSA-9wx4-h78v-vm56","GHSA-gc5v-m9x4-r6x2","PYSEC-2026-1872","PYSEC-2026-1873","PYSEC-2026-2275"]},"first_published":"2011-02-14","last_release":"2026-05-14","age_days":5720,"licenses":["Apache-2.0"],"deprecated":false,"install_scripts":null,"maintainers":null,"downloads_last_week":null,"provenance":false,"source_repo":"github.com/psf/requests","stars":54469,"scorecard":8.2,"url":"https://deps.dev/pypi/requests/2.31.0"},{"ecosystem":"npm","name":"lodahs","requested":null,"version":"0.0.1-security","version_note":"no version given, checked the default (latest) version","verdict":"BLOCK","exists":true,"reasons":[{"code":"malicious","level":"block","detail":"lodahs@0.0.1-security is flagged as malicious: MAL-2025-25502 Malicious code in lodahs (npm)"},{"code":"stale","level":"info","detail":"No release for 6 years."},{"code":"typosquat_suspect","level":"block","detail":"Name is one typo away from the much more popular \"lodash\" (163,592,467 downloads last week). Did you mean lodash?"},{"code":"low_scorecard","level":"info","detail":"OpenSSF Scorecard 2.2/10."}],"latest_version":"0.0.1-security","upgrade_to":null,"malicious":true,"vulnerabilities":{"total":0,"critical":0,"high":0,"moderate":0,"low":0,"ids":[]},"first_published":"2019-11-25","last_release":"2019-11-25","age_days":2513,"licenses":[],"deprecated":false,"install_scripts":[],"maintainers":1,"downloads_last_week":170,"provenance":false,"source_repo":"github.com/npm/security-holder","stars":163,"scorecard":2.2,"url":"https://deps.dev/npm/lodahs/0.0.1-security"}],"sources":"deps.dev and OSV.dev (CC-BY 4.0), npm registry, PyPI, crates.io, Go module proxy, NuGet, RubyGems","checked_at":"2026-10-13T09:28:01.071Z"},"trial":{"free":true,"used_example_input":true,"input_used":{"packages":["express@4.17.1","reqeusts","pypi:requests==2.31.0","lodahs"]},"remaining_today":2,"resets_at":"2026-10-14T00:00:00.000Z","note":"Real output for the example input. The paid endpoint returns the same format for your own input."},"paid_endpoint":"https://agentsvc.io/api/v1/proxy/package-check","price_usdc":0.004,"payment":"x402, USDC on Base, Solana, Polygon or Arbitrum mainnet, no account needed","docs":"https://agentsvc.io/docs"}