Service details

Package Vulnerability Lookup

Check an exact package version against vulnerability advisories and known exploitation evidence. Your assistant calls the service and brings the result back into your task.

Check an exact npm or PyPI package version against CVE vulnerability advisories and CISA known exploitation with fixed-version evidence

0.01 USDC per completed diagnostic

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know its boundaries.

Guaranteeing safety, detecting unknown vulnerabilities or malware, resolving dependency trees, checking package existence or independently corroborating OSV.

Data handling

Package name and ecosystem are sent only to OSV; the complete public CISA catalog is read from its official GitHub mirror. Inputs, results and proofs are excluded from logs. Completed results remain encrypted for 30 day original-proof recovery.

Input example and exact contract

{
  "ecosystem": "pypi",
  "name": "requests",
  "version": "2.19.0",
  "request_id": "package-vulnerability-example-001"
}

API reference: input, output and error schemas →

Example output

{
  "status": "ok",
  "ecosystem": "pypi",
  "name": "requests",
  "version": "2.19.0",
  "verdict": "affected",
  "advisories": [
    {
      "id": "GHSA-mekl-0000-0001",
      "aliases": [
        "CVE-2026-99901"
      ],
      "modified": "2026-10-20T00:00:00Z",
      "version_status": "affected",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.20.0"
            }
          ]
        }
      ],
      "fixed_versions_reported": [
        "2.20.0"
      ],
      "listed_version_match": false,
      "source_url": "https://osv.dev/vulnerability/GHSA-mekl-0000-0001",
      "known_exploitation": [
        {
          "cve": "CVE-2026-99901",
          "date_added": "2026-10-20",
          "due_date": "2026-11-10",
          "ransomware_use": "Unknown"
        }
      ]
    }
  ],
  "vulnerability_groups": [
    {
      "identifiers": [
        "CVE-2026-99901",
        "GHSA-mekl-0000-0001"
      ],
      "advisory_ids": [
        "GHSA-mekl-0000-0001"
      ],
      "version_status": "affected",
      "source_disagreement": false
    }
  ],
  "withdrawn_advisory_ids": [],
  "observed_at": "2026-10-21T00:00:00Z",
  "coverage": {
    "advisory_records": 1,
    "withdrawn_records": 0,
    "pages": 1,
    "query_complete": true,
    "osv_source": "https://api.osv.dev/v1/query",
    "kev_source": "https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json",
    "kev_catalog_version": "2026.10.20",
    "kev_released_at": "2026-10-20T00:00:00Z",
    "kev_count": 1
  },
  "limitations": [
    "No known matches means no affected version found in this bounded OSV response; unknown, unpublished, missing or newly changed advisories remain possible.",
    "Only the supplied exact package/version is checked. No dependency resolution, code execution, malware scan, registry-existence check or installation-safety guarantee.",
    "GitHub and PyPI advisory records are obtained through OSV, not independently corroborated. Aliases group source assertions; disagreements remain visible.",
    "Fixed versions are source-reported boundaries, not a recommended upgrade or a guarantee against other vulnerabilities. Prereleases use version ordering, not npm installer range selection.",
    "CISA catalog membership is exploitation evidence for the CVE, not proof that this package deployment is exploitable. Absence is not evidence of no exploitation."
  ]
}

Calling, result interpretation and recovery

Calling

Endpoint: POST /v1/data/packages/check-version-vulnerabilities
Content type: application/json
Input: All fields, formats, defaults and limits are specified in requestBody. request_id must be 16–64 ASCII letters, digits, underscores or hyphens; use a fresh value per new purchase.

Interpret the result

Status: ok means the bounded diagnostic completed; affected and review_required are charged completed results.
Result: affected means at least one active source record matches; review_required means unsupported evidence prevents a verdict; no_known_matches is never a safety verdict. Inspect disagreements and source-reported fixes.
Recovery: Resend identical input and original proof for 30 day encrypted recovery; never pay again for pending work.
Example: The published response example is synthetic. Live results carry actual advisory identifiers and observation dates.

Limits

Request bytes

24000

Semantics

Unsigned quotes do no source work. Complete normalized input is bound before authorization.
At most 100 advisory records across four pages, 4 MiB per source response and 200000 output bytes. Limits or source failures are uncharged.
CISA catalog must be no more than seven days old, with one-day future clock tolerance. Source observation is not a guarantee that OSV is current or complete.
Advisories use local PEP 440 or SemVer ordering, exact enumerations and supported intervals. Unsupported evidence remains unknown. Fixed boundaries are reported, never recommended blindly.
Commit ranges are retained; release-version matching uses release ranges or enumerated versions when present. Commit-only entries remain unknown.

Payment and recovery

Price

0.01 native USDC per completed operation

Network

Solana mainnet or Base mainnet

Protocol

x402 v2 exact

Quote

POST the intended JSON unsigned for one input-bound 402; no work/source retrieval occurs. Sign one offer and resend identical JSON. Work and encrypted storage complete before settlement.

Authorization

Choose one accepts entry with a standard x402 v2 client. Check native USDC, network, recipient, amount and intended input before signing. Solana uses an SVM transaction; Base uses an EOA EIP-3009 authorization (USD Coin version 2). Send the proof with identical JSON input. No API key, token approval, bridge or Solana wallet is needed for Base. Never automatically fall back to another network.

Retry

Preserve identical JSON and original proof for 30 day result recovery; do not buy again after a timeout or pending result. Fresh request_id creates a new paid operation.

Finality

A 202 is pending. Finalized delivery carries PAYMENT-RESPONSE; provisional delivery is separately labeled and does not establish finality. Preserve the original proof instead of buying again.

Expiry

Ongoing service under recurring monthly authority. Budget warnings do not stop service. Short-lived quotes and recovery retention still expire.

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Assets

Solana:5eykt4usfv8p8njdtrepy1vzqkqzkvdp: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
Eip155:8453: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Fees

CDP sponsors the payment transaction gas on both networks. The service price is the same on either network; wallet funding or exchange fees are separate.

Request binding

The server authenticates the complete quote and input and atomically binds the first accepted authorization to them. Standard Base EIP-3009 signs the money terms and nonce, not HTTP content. Keep signatures private; do not reuse an authorization for another quote, operation or body.