Package Security Audit

Audit an npm or PyPI package for security risks, including signs of a supply-chain attack.

Pay by wallet (x402) package-security-audit

Example

Input

{
  "name": "lodash",
  "ecosystem": "npm"
}

Answer

{
  "name": "lodash",
  "license": {
    "spdx": "MIT",
    "is_copyleft": false,
    "is_osi_approved": true
  },
  "version": "4.18.1",
  "ecosystem": "npm",
  "freshness": {
    "is_latest": true,
    "published_at": "2026-04-01T21:01:20.458Z",
    "is_deprecated": false,
    "latest_version": "4.18.1",
    "version_age_hours": 5013,
    "recently_published": false,
    "days_since_last_release": 208
  },
  "scorecard": null,
  "risk_level": "low",
  "risk_score": 100,
  "maintainers": 1,
  "supply_chain": {
    "provenance": {
      "has_attestation": false,
      "attestation_missing": false,
      "previous_had_attestation": false
    },
    "current_publisher": "jdalton",
    "publisher_changed": false,
    "previous_publisher": "jdalton",
    "has_install_scripts": false,
    "install_script_names": []
  },
  "vulnerabilities": {
    "low": 0,
    "high": 0,
    "total": 0,
    "medium": 0,
    "details": [],
    "critical": 0
  },
  "dependency_count": 0
}

Inputs

Field	Type	Required	What it is
`name`	string	Yes	Package name
`version`	string	No	Version to audit
`ecosystem`	string	No	npm or pypi

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`name`	string	Always (present in every successful answer)
`license`	object	Usually (present for most inputs)
`version`	string	Always (present in every successful answer)
`ecosystem`	string	Always (present in every successful answer)
`freshness`	object	Always (present in every successful answer)
`risk_level`	string	Always (present in every successful answer)
`risk_score`	integer	Always (present in every successful answer)
`supply_chain`	object	Always (present in every successful answer)
`vulnerabilities`	object	Usually (present for most inputs)
`scorecard`	—	Sometimes (present only for some inputs)
`maintainers`	—	Usually (present for most inputs)
`dependency_count`	—	Usually (present for most inputs)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "package-security-audit",
    "inputs": {
      "name": "lodash",
      "ecosystem": "npm"
    },
    "max_price_cents": 5
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "package-security-audit",
    "inputs": {
      "name": "lodash",
      "ecosystem": "npm"
    },
    "max_price_cents": 5
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "package-security-audit",
  inputs: {
    "name": "lodash",
    "ecosystem": "npm"
  },
  max_price_cents: 5,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="package-security-audit",
    inputs={
        "name": "lodash",
        "ecosystem": "npm",
    },
    max_price_cents=5,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/package-security-audit?name=lodash&ecosystem=npm'

Limitations

Vulnerability data depends on OSV.dev availability
If OSV.dev is down, vulnerability data returns null but other signals still produce a risk score.
Publisher change detection is npm-only
PyPI does not expose per-version publisher data in the registry API, so publisher_changed is null for PyPI packages.
Provenance check requires deps.dev data
If deps.dev is unavailable or the package is not indexed, provenance attestation fields return null.

Bundled checks that include it

Dependency Risk Check €0.25