Service details

Package Identity Checks

Check that a package name and version exist and compare potentially confusing names. Your assistant calls the service and brings the result back into your task.

Check public PyPI or npm package identity and a requested version

0.005 USDC per accepted request

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know its boundaries.

Malware analysis, vulnerability clearance, publisher verification, package execution or exhaustive typosquat detection.

Data handling

Supplied inputs, source results and proofs are excluded from telemetry. Completed results remain encrypted for 30 day original-proof recovery. Feed URLs use robots/DNS controls; package names go only to PyPI/npm. TLS connects only to the public hostname on port 443. Document and schedule processing is local to the service runtime.

Input example and exact contract

{
  "ecosystem": "pypi",
  "name": "pip",
  "compare_names": [
    "pip-tools"
  ],
  "request_id": "package-identity-example-001"
}

API reference: input, output and error schemas →

Example output

{
  "status": "ok",
  "ecosystem": "pypi",
  "identity": {
    "exists": true,
    "name": "pip",
    "version": "1.0.0",
    "source_url": "https://pypi.org/pypi/pip/json",
    "requested_version": null,
    "package_exists": true,
    "version_exists": null
  },
  "comparisons": [
    {
      "exists": true,
      "name": "pip-tools",
      "version": "1.0.0",
      "source_url": "https://pypi.org/pypi/pip-tools/json",
      "requested_version": null,
      "package_exists": true,
      "version_exists": null,
      "edit_distance": 6,
      "same_normalized_name": false,
      "possible_name_confusion": false
    }
  ],
  "observed_at": "2026-10-20T00:00:00Z",
  "limitations": [
    "Public PyPI and npm registry lookup at observation time; no package is downloaded or executed.",
    "Existence is not authenticity, security, vulnerability clearance or a recommendation to install. A missing requested version does not establish that the package name is absent.",
    "Name-confusion evidence compares only the supplied maximum five candidates using normalized names and Levenshtein distance <= 2; it is not an exhaustive typosquat search.",
    "Registry maintainer identities, emails and package descriptions are excluded. Deleted, transferred or newly published packages may change after this observation."
  ]
}

Calling, result interpretation and recovery

Calling

Endpoint: POST /v1/data/packages/check-registry-identity
Content type: application/json
Input: All fields, formats, defaults and limits are specified in requestBody. request_id must be 16–64 ASCII letters, digits, underscores or hyphens; use a fresh value per new purchase.

Interpret the result

Status: ok means the documented bounded operation completed; inspect explicit coverage and limitations.
Result: Response schema describes each output. Null means missing/unknown, never measured zero.
Recovery: Use the original body and payment proof after timeout, pending settlement or quote expiry.

Limits

Request bytes

24000

Semantics

No work occurs on unsigned quotes. Normalize and bind the complete input before payment.
Successful results are encrypted for 30 day original-proof recovery.
Incomplete operation or source/storage failure is uncharged. A completed diagnostic or zero-match lookup is charged.

Payment and recovery

Price

0.005 native USDC per completed operation

Network

Solana mainnet or Base mainnet

Protocol

x402 v2 exact

Quote

POST the intended JSON unsigned for one input-bound 402; no work/source retrieval occurs. Sign one offer and resend identical JSON. Work and encrypted storage complete before settlement.

Authorization

Choose one accepts entry with a standard x402 v2 client. Check native USDC, network, recipient, amount and intended input before signing. Solana uses an SVM transaction; Base uses an EOA EIP-3009 authorization (USD Coin version 2). Send the proof with identical JSON input. No API key, token approval, bridge or Solana wallet is needed for Base. Never automatically fall back to another network.

Retry

Preserve identical JSON and original proof for 30 day result recovery; do not buy again after a timeout or pending result. Fresh request_id creates a new paid operation.

Finality

A 202 is pending. Finalized delivery carries PAYMENT-RESPONSE; provisional delivery is separately labeled and does not establish finality. Preserve the original proof instead of buying again.

Expiry

Ongoing service under recurring monthly authority. Budget warnings do not stop service. Short-lived quotes and recovery retention still expire.

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Assets

Solana:5eykt4usfv8p8njdtrepy1vzqkqzkvdp: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
Eip155:8453: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Fees

CDP sponsors the payment transaction gas on both networks. The service price is the same on either network; wallet funding or exchange fees are separate.

Request binding

The server authenticates the complete quote and input and atomically binds the first accepted authorization to them. Standard Base EIP-3009 signs the money terms and nonce, not HTTP content. Keep signatures private; do not reuse an authorization for another quote, operation or body.