Check malicious dependencies API

Look for OSV malicious-package advisories that name the same ecosystem and package. No advisory does not mean the package is free of malware.

The Check malicious dependencies operation is part of the Software Supply Chain Security API on BRAINIAC.software. Look for OSV malicious-package advisories that name the same ecosystem and package. No advisory does not mean the package is free of malware. It is exposed as POST /api/v1/software-security/malicious-dependency-check and priced at $0.06 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: OSV public API (api.osv.dev). CISA Known Exploited Vulnerabilities catalog JSON feed. Public npm, PyPI, crates.io, and RubyGems package records for licence identifiers. Limitations: CycloneDX and SPDX JSON are accepted, with a limited XML read of the same fields. Only an exact ecosystem, package name, and version is matched. Similar names are ignored. Affected, unaffected, and unknown version ranges are reported separately. At most 25 components and 40 advisory documents are read per call. Absence of an advisory does not mean a dependency is safe or free of malware. Licence compatibility is judged only against the caller allow and deny lists. EPSS, NVD, deps.dev, and Scorecard are not used by this product. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Match SBOM vulnerabilities, Report dependency risk, Check KEV exposure, Check licence compatibility. Open the group documentation for the full request schema, field notes, and response examples before integrating.