{"api":"v1","generated_at":"2026-10-01T06:53:21.634Z","licence":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"TOLL, with a link to the page cited"},"page":"https://tollindex.com/e/apexfaucet-xyz-api-x402-software-risk-b8031a","pinned_page":"https://tollindex.com/e/apexfaucet-xyz-api-x402-software-risk-b8031a/at/2026-10-01T05-50Z","pinned":false,"method":"https://tollindex.com/ledger/method","snapshot_at":"2026-10-01T05:50:06.230Z","snapshot_stamp":"2026-10-01T05-50Z","endpoint":{"slug":"apexfaucet-xyz-api-x402-software-risk-b8031a","canonical_url":"https://apexfaucet.xyz/api/x402/software-risk","resource":"https://apexfaucet.xyz/api/x402/software-risk","http_method":"GET","type":"http","x402_version":2,"registries":["cdp"],"primary_registry":"cdp","curated_by_coinbase":false,"description":"Known vulnerabilities for one package version from OSV.dev, with CISA exploited-in-the-wild flag and the fixed version. Should I install this? Pass ?package=lodash&ecosystem=npm&version=4.17.15 (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Hex, Pub) and get every known advisory for that exact version from OSV.dev (GitHub, PyPA, Go and RustSec databases), whether any of them is on CISA's Known Exploited Vulnerabilities list, severity, and the version that fixes each.","service_name":"APEX Package vulnerability + KEV","declared_category":null,"declared_tags":["vulnerability","security","npm","cve","dependencies"],"route_template":null,"registry_updated":"2026-09-30T11:36:20.210Z"},"derived":{"note":"fields no registry supplies; TOLL derives them and marks them derived on the page","title":"software risk","category":"other","first_observed_by_toll":"2026-09-30T12:32:05.628Z","last_observed_by_toll":"2026-10-01T05:50:06.230Z","observation_began":"2026-09-10"},"presence":{"listed_now":true,"first_absent_at":null,"delisting_confirmed_at":null,"events":[{"registry":"cdp","at":"2026-09-30T12:32:05.628Z","event":"listed"}]},"accepts":[{"registry":"cdp","ordinal":0,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.003 USDC","amount_units":0.003,"decimals_known":true,"pay_to":"0xd334ab5151c624cada654854e2879903dc4217ed","scheme":"exact"},{"registry":"cdp","ordinal":1,"network":"eip155:5042","asset":"0x3600000000000000000000000000000000000000","asset_name":"USDC","symbol":null,"decimals":null,"amount_display":"3000 smallest units, decimals unknown","amount_units":null,"decimals_known":false,"pay_to":"0xd334ab5151c624cada654854e2879903dc4217ed","scheme":"exact"},{"registry":"cdp","ordinal":2,"network":"eip155:5042","asset":"0x3600000000000000000000000000000000000000","asset_name":"GatewayWalletBatched","symbol":null,"decimals":null,"amount_display":"3000 smallest units, decimals unknown","amount_units":null,"decimals_known":false,"pay_to":"0xd334ab5151c624cada654854e2879903dc4217ed","scheme":"exact"},{"registry":"cdp","ordinal":3,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"GatewayWalletBatched","symbol":"USDC","decimals":6,"amount_display":"0.003 USDC","amount_units":0.003,"decimals_known":true,"pay_to":"0xd334ab5151c624cada654854e2879903dc4217ed","scheme":"exact"},{"registry":"cdp","ordinal":4,"network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","asset_name":null,"symbol":"USDC","decimals":6,"amount_display":"0.003 USDC","amount_units":0.003,"decimals_known":true,"pay_to":"HYiepS7mNCVVKoaDmZLQ6rNtMWHTQqKheM1NLGn1x8kJ","scheme":"exact"}],"counters":{"observed_at":"2026-10-01T05:50:06.230Z","calls_30d":1,"unique_payers_30d":1,"last_called_at":"2026-09-30T11:36:19.869Z"},"validation":{"latest":{"observed_at":"2026-09-30T12:34:49.023Z","state":"pass","failed_checks":[],"endpoint_http_status":402,"run_id":"new-after-daily-2026-09-30"},"uptime":[{"days":7,"observed":1,"passed":1,"ratio":1},{"days":30,"observed":1,"passed":1,"ratio":1},{"days":90,"observed":1,"passed":1,"ratio":1}],"history_90d":[{"observed_at":"2026-09-30T12:34:49.023Z","state":"pass","failed_checks":[],"run_id":"new-after-daily-2026-09-30","state_changed":true}]},"seller":{"wallet":"0xd334ab5151c624cada654854e2879903dc4217ed","page":"https://tollindex.com/seller/0xd334ab5151c624cada654854e2879903dc4217ed","endpoints":75,"hosts":1},"reports":0,"registry_record":{"cdp":[{"tags":["vulnerability","security","npm","cve","dependencies"],"type":"http","accepts":[{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","note":"Sign an EIP-3009 transferWithAuthorization to payTo and send it base64 in PAYMENT-SIGNATURE - we settle it and you pay no gas. Or pay and replay the hash in X-PAYMENT-BASE.","version":"2","replayHeader":"X-PAYMENT-BASE","credentialTypes":["authorization"]},"payTo":"0xd334ab5151c624cada654854e2879903dc4217ed","amount":"3000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300},{"asset":"0x3600000000000000000000000000000000000000","extra":{"rpc":"https://rpc.mainnet.arc.io","name":"USDC","note":"Sign an EIP-3009 transferWithAuthorization to payTo and send it base64 in PAYMENT-SIGNATURE - we settle it and you pay no gas. Or, since USDC is also the native gas token on Arc, send a plain value transfer to payTo and replay the hash in X-PAYMENT-ARC. Finality is instant on inclusion.","version":"2","replayHeader":"X-PAYMENT-ARC","credentialTypes":["authorization"]},"payTo":"0xd334ab5151c624cada654854e2879903dc4217ed","amount":"3000","scheme":"exact","network":"eip155:5042","maxTimeoutSeconds":300},{"asset":"0x3600000000000000000000000000000000000000","extra":{"name":"GatewayWalletBatched","note":"Circle Gateway nanopayment: pay from your Gateway balance with a gas-free signature (validBefore at least 7 days out). Settled by Circle in batches.","version":"1","verifyingContract":"0x77777777dcc4d5a8b6e418fd04d8997ef11000ee"},"payTo":"0xd334ab5151c624cada654854e2879903dc4217ed","amount":"3000","scheme":"exact","network":"eip155:5042","maxTimeoutSeconds":604900},{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"GatewayWalletBatched","note":"Circle Gateway nanopayment: pay from your Gateway balance with a gas-free signature (validBefore at least 7 days out). Settled by Circle in batches.","version":"1","verifyingContract":"0x77777777dcc4d5a8b6e418fd04d8997ef11000ee"},"payTo":"0xd334ab5151c624cada654854e2879903dc4217ed","amount":"3000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":604900},{"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","extra":{"feePayer":"D93NE2kMj88BPsHfdZZ4A1HX2CGo14Y18Bdb3J4qtD5c"},"payTo":"HYiepS7mNCVVKoaDmZLQ6rNtMWHTQqKheM1NLGn1x8kJ","amount":"3000","scheme":"exact","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","maxTimeoutSeconds":300}],"quality":{"lastCalledAt":"2026-09-30T11:36:19.869Z","l30DaysTotalCalls":1,"l30DaysUniquePayers":1},"resource":"https://apexfaucet.xyz/api/x402/software-risk","extensions":{"bazaar":{"info":{"input":{"type":"http","method":"GET","queryParams":{"package":"lodash","version":"4.17.15","ecosystem":"npm"},"discoverable":true},"output":{"type":"json","schema":{"type":"object","properties":{"ok":{"type":"boolean"},"data":{"type":"object"},"paid":{"type":"number"}}},"example":{"ok":true,"data":{},"paid":0.003}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["package","ecosystem","version"],"properties":{"package":{"type":"string","maxLength":214,"minLength":1,"description":"Package name exactly as the registry has it (Maven: group:artifact)."},"version":{"type":"string","maxLength":64,"minLength":1,"description":"The exact version to check."},"ecosystem":{"enum":["npm","PyPI","Go","crates.io","Maven","NuGet","RubyGems","Packagist","Hex","Pub"],"type":"string","description":"Package ecosystem."}}}}},"output":{"type":"object"}}}}},"description":"Known vulnerabilities for one package version from OSV.dev, with CISA exploited-in-the-wild flag and the fixed version. Should I install this? Pass ?package=lodash&ecosystem=npm&version=4.17.15 (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Hex, Pub) and get every known advisory for that exact version from OSV.dev (GitHub, PyPA, Go and RustSec databases), whether any of them is on CISA's Known Exploited Vulnerabilities list, severity, and the version that fixes each.","lastUpdated":"2026-09-30T11:36:20.21Z","serviceName":"APEX Package vulnerability + KEV","x402Version":2}]}}