{"name":"npm-trust-pack","description":"Vets an npm package before install in one call: supply-chain risk score plus registry stats. Composite: one call runs package-risk-npm + npm-package-stats in parallel for any npm package (scoped names supported). Returns the 0-10 risk score with risk_level bucket, contributing factors, typosquat candidates, and plain-English summary, plus the raw registry metrics: latest version, version count, age, days since last release, maintainer list, and last day/week/month/year downloads. Includes composed_of + per-component telemetry; partial failure degrades instead of failing. Use it as an npm install pre-flight, typosquat check + downloads + maintainers bundle, or Socket.dev-adjacent vetting bundle.","price":"$0.04","method":"POST","input_schema":{"properties":{"package":{"type":"string","description":"npm package name. Supports scoped names ('@types/node'). Max 214 chars."}},"required":["package"]},"input_example":{"package":"lodash"},"output_example":{"package":"lodash","risk":{"score":5,"risk_level":"low","typosquat_candidates":[]},"stats":{"latest_version":"4.17.21","total_versions":114,"downloads":{"last_week":78200000}},"composed_of":["package-risk-npm","npm-package-stats"],"components":[{"name":"package-risk-npm","ok":true,"ms":2900},{"name":"npm-package-stats","ok":true,"ms":640}],"degraded":false},"x402_payment_required":true,"x402_facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}