← The evidence ledger
Evidence row 70836
Observed , by baseline/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://api.youraitools.co/pkgguard/v1/package
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 60b2fcf559a8670f95a6be2b68277e36e65ebf87c43db0052680f00e196dab22
- Leaf
- 0x327fe07449975eea80fa4c70bc5726f73e1b13e53ac341803a254f6cb51ad135
What was observed
{
"endpoints": [
[
"x402",
"https://api.youraitools.co/pkgguard/v1/package"
]
],
"name": "PkgGuard by AgentGate",
"owner_address": "0x3c1a1e01e790cd326495631b3b38bd7068f08d6f",
"raw": {
"accepts": [
{
"amount": "1000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:8453",
"payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
"scheme": "exact"
},
{
"amount": "1000",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:137",
"payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
"scheme": "exact"
},
{
"amount": "1000",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:42161",
"payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
"scheme": "exact"
},
{
"amount": "1000",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
},
"maxTimeoutSeconds": 120,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte",
"scheme": "exact"
}
],
"description": "Package vulnerability lookup API. Is this package version safe to install? Known vulnerabilities (CVE/GHSA ids, severity, CVSS score, fixed-in versions) and malicious-package flags for one npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven or NuGet package version, from OSV.dev. Search intents: package vulnerability check, is this npm package safe, cve lookup api, pypi vulnerability, malicious package check, osv lookup.",
"extensions": {
"bazaar": {
"info": {
"input": {
"method": "GET",
"queryParams": {
"ecosystem": "npm",
"name": "lodash",
"version": "4.17.15"
},
"type": "http"
},
"output": {
"example": {
"advisory_count": 6,
"disclaimer": "Informational: lists published advisories from OSV.dev for the versions given.",
"highest_severity": "HIGH",
"malicious_count": 0,
"package_count": 1,
"packages": [
{
"ecosystem": "npm",
"highest_severity": "HIGH",
"malicious": false,
"name": "lodash",
"version": "4.17.15",
"version_source": "exact",
"vuln_count": 6,
"vulns": [
{
"aliases": [
"CVE-2021-23337"
],
"cvss_score": 7.2,
"fixed_in": [
"4.17.21"
],
"id": "GHSA-35jh-r3h4-6jhm",
"malicious": false,
"severity": "HIGH",
"summary": "Command Injection in lodash",
"url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
}
]
}
],
"scanned_count": 1,
"source": {
"name": "OSV.dev"
},
"tier": "full",
"unpinned_count": 0,
"verdict": "vulnerable",
"vulnerable_count": 1
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"description": "Search intents: package vulnerability check, is this npm package safe, cve lookup api, pypi vulnerability, malicious package check, osv lookup",
"properties": {
"ecosystem": {
"description": "One of npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet, Pub, Hex (default npm)",
"type": "string"
},
"name": {
"description": "Package name, e.g. lodash",
"type": "string"
},
"version": {
"description": "Exact version, e.g. 4.17.15",
"type": "string"
}
},
"required": [
"name",
"version"
],
"type": "object"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"advisory_count": {
"type": "number"
},
"disclaimer": {
"type": "string"
},
"highest_severity": {
"type": "string"
},
"malicious_count": {
"type": "number"
},
"package_count": {
"type": "number"
},
"packages": {
"type": "array"
},
"scanned_count": {
"type": "number"
},
"source": {
"type": "object"
},
"tier": {
"type": "string"
},
"unpinned_count": {
"type": "number"
},
"verdict": {
"type": "string"
},
"vulnerable_count": {
"type": "number"
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1792634264/bazaar-icons/24b9b478d3f15ec3.png",
"lastUpdated": "2026-10-25T18:56:54.711Z",
"quality": {
"l30DaysTotalCalls": 6,
"l30DaysUniquePayers": 4,
"lastCalledAt": "2026-10-25T18:56:54.216Z"
},
"resource": "https://api.youraitools.co/pkgguard/v1/package",
"serviceName": "PkgGuard by AgentGate",
"tags": [
"security",
"dependencies",
"vulnerability-scan",
"supply-chain",
"malware"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Package vulnerability lookup API. Is this package version safe to install? Known vulnerabilities (CVE/GHSA ids, severity, CVSS score, fixed-in versions) and malicious-package flags for one npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven or NuGet package version, from OSV.dev. Search intents: package vulnerability check, is this npm package safe, cve lookup api, pypi vulnerability, malicious package check, osv lookup."
}What the leaf hashes
{"body":"60b2fcf559a8670f95a6be2b68277e36e65ebf87c43db0052680f00e196dab22","id":70836,"kind":"listing","method":"baseline/1","observed_us":1793025480958845,"prev":null,"subject":"x402_bazaar:https://api.youraitools.co/pkgguard/v1/package","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x327fa4567c1965626b65d24ee87aa759ffa202b45772caaf8f271d479f1aa292
- 0x92d2eb4e53be7d97926f2494d7eb13818ee09b89bebe5bea57150e9a48e8989f
- 0x4a01c073e34fef87f0f028872e1a63709ab467710727fe2ca1a52f84776a8612
- 0x76d3b5655c32b235344cdebbf808f845ba70dd0d77d57480e1289749043c1f48
- 0xdaa54a388f39618dcf258efe61a11c4325c747672d0e96db9e321b2701aef2e3
- 0x640c9a508fdc3c81e64cf7f708111cf7c765f7571257c0b31ce6cbc9b1a57902
- 0x67edb7d4c53f5bcff89434b874bc69139bb5576d19574b48e70828e87a3737e0
- 0xe7f2d3457c053448eebcc931645ff5ada0933cb5c24ad253c177f41b200802d9
- 0x7186e930ab2d6340c1f9e36a0a16f77d602f22cd5bb13d9e666145bff3ba96f0
- 0x6f4fdc0c2e1b3d84e2b1d6729c3f9a04bcd118e81d7bf76e3ca851a0dd1ede43
- 0x631846da76ec1e8570c7c09dada1cc0affff7b5654335239fd84d2059c750b13
- 0x2f4617d7a962f32849050ad5649d9dc4f962fd8618073cfa8519e6f862dfcef8
- 0x08de74b7fb265ddb83e4c673da8a94e5f71829b2e6e7464c71c5138e450f2217
- 0x4338355a835617a26aa0bfcc971e84eb030d84e2aa840e3c8af958921dd080c7
- 0x610738e0c43687aded83c613c73de8b5226c73c375858a167436461c522ea213
- 0x06d71bfa7d8b41d62c8836efc2c601e1cc3772d9453596b2ae4950887f3310ca
- 0x8c756542e482157df0c36464d75c937b845e4423dbbcfad08f0cf8d5a16b9a13
- 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae