Package Risk Npm

Scores supply-chain risk for an npm package before you install it.

Overview

Scores supply-chain risk for an npm package before you install it. Pulls registry metadata + download stats for the package (and optional version) and checks maintainer count, weekly downloads, install / postinstall script hooks, dependency tree depth, deprecation flag, package age, last-publish recency, and edit-distance to popular package names (typosquat). Returns a 0-10 score, risk_level bucket, contributing factors, typosquat candidate list, and a Venice plain-English summary. Use it as an npm supply-chain scanner, typosquat detector, postinstall-script flagger, npm install pre-flight audit, package.json + pnpm-lock.yaml vetter, or Snyk-adjacent / Socket.dev-adjacent pre-install safety gate.

Endpoint

Method	Endpoint	Price	Description
POST	/v1/marketplace/api/package-risk-npm	$0.0345	Invoke Package Risk Npm (General) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i -X POST https://api.jarvisclaw.ai/v1/marketplace/api/package-risk-npm \
  -H 'Content-Type: application/json' \
  -d '{}'

# 2. Pay it (the SDK signs and retries for you)
curl -X POST https://api.jarvisclaw.ai/v1/marketplace/api/package-risk-npm \
  -H 'Content-Type: application/json' \
  -H 'X-PAYMENT: <signed-payload>' \
  -d '{}'

Open in the marketplace