Evidence row 61254

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://agent-data.centorprat.workers.dev/tools/package-dependency-risk-scanner"
    ]
  ],
  "name": "Package Dependency Risk Scanner",
  "owner_address": "0x8d38d6026cf3a9805de9c5f0611cee95b532b120",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x8d38D6026cf3A9805DE9c5F0611ceE95B532B120",
        "scheme": "exact"
      },
      {
        "amount": "10000",
        "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:137",
        "payTo": "0x8d38D6026cf3A9805DE9c5F0611ceE95B532B120",
        "scheme": "exact"
      },
      {
        "amount": "10000",
        "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
        "extra": {
          "feePayer": "D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM"
        },
        "maxTimeoutSeconds": 300,
        "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "payTo": "3644DrcePengCVjznEa59Dm7Mu7Acr522NvYyapHRHQh",
        "scheme": "exact"
      }
    ],
    "description": "Give it npm or PyPI package names. For each it reads the registry metadata and latest version (and npm download counts) and queries OSV.dev for known security advisories, then composes a risk brief: known vulnerabilities, deprecation, staleness and a signal. Keyless, agent-callable. One search per call (result caps in the input schema); failed lookups are not charged.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "ecosystem": "npm",
              "packages": [
                "lodash"
              ]
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "items": [
                {
                  "checkedVersion": "4.18.1",
                  "created": "2012-04-23T16:37:11.912Z",
                  "deprecated": false,
                  "deprecatedReason": null,
                  "ecosystem": "npm",
                  "found": true,
                  "homepage": "https://lodash.com/",
                  "lastPublish": "2026-04-01T21:01:20.458Z",
                  "latestVersion": "4.18.1",
                  "license": "MIT",
                  "maintainers": 1,
                  "name": "lodash",
                  "query": "lodash",
                  "weeklyDownloads": 94515109
                }
              ]
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "properties": {
                    "ecosystem": {
                      "description": "Used for package names without an npm:/pypi: prefix.",
                      "enum": [
                        "npm",
                        "pypi"
                      ],
                      "type": "string"
                    },
                    "packages": {
                      "description": "e.g. [\"lodash\", \"express@4.18.0\", \"pypi:requests\", \"npm:@babel/core\"]. Prefix with npm: or pypi: to pick the ecosystem (else the default below); add @version (npm) or ==version (PyPI) to check a specific version. One brief per package.",
                      "items": {
                        "type": "string"
                      },
                      "maxItems": 5,
                      "type": "array"
                    }
                  },
                  "required": []
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST",
                    "PUT",
                    "PATCH"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-25T17:14:40.425Z",
    "quality": {
      "l30DaysTotalCalls": 3,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-25T17:14:40.138Z"
    },
    "resource": "https://agent-data.centorprat.workers.dev/tools/package-dependency-risk-scanner",
    "serviceName": "Package Dependency Risk Scanner",
    "tags": [
      "security",
      "npm",
      "supply-chain",
      "data"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Give it npm or PyPI package names. For each it reads the registry metadata and latest version (and npm download counts) and queries OSV.dev for known security advisories, then composes a risk brief: known vulnerabilities, deprecation, staleness and a signal. Keyless, agent-callable. One search per call (result caps in the input schema); failed lookups are not charged."
}

What the leaf hashes

{"body":"1e75650ebd0d2b7878e1593c3eef3bb03018c2676eed4dd16275f4bb9bfc6005","id":61254,"kind":"listing","method":"baseline/1","observed_us":1793025450381121,"prev":null,"subject":"x402_bazaar:https://agent-data.centorprat.workers.dev/tools/package-dependency-risk-scanner","subject_kind":"source_record"}

Proof

Its day has not closed yet. A day closes ten minutes after midnight UTC; the proof appears here then.