datastand.dev
The latest npm security advisories, normalized for machines: severity, CVSS, affected packages, vulnerable ranges, patched versions. Merged from two upstream orderings — the 100 most recently published advisories and the 100 most recently REVISED — so a CVSS score finally assigned, or a vulnerable range widened to include the version you run, reaches you instead of being invisible because the advisory was published weeks ago. Derived from the GitHub Advisory Database (CC-BY 4.0, attributed). Add ?since=<ISO-8601> to get only the advisories published or revised since your last fetch; if nothing has changed you are not charged, so polling for new vulnerabilities costs nothing until there are some. Every build carries a `coverage` block stating what it can and cannot answer: `delta_complete_since` is the point back to which a ?since= delta is complete — ask for one earlier and it is refused for free rather than served short — and `upstream_unchanged_since` says how long upstream has been serving the same newest advisory, because generated_at is the age of our fetch and not the age of the content. That block is on this free listing (info.output.example.coverage) at the current build's own figures, so you can check the bound against your polling interval before you pay for anything.
The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.
Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.
Live 402 challenge
Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.
{
"error": "payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x470a1b647d668d3820add26d70c8371557ff4c6b",
"scheme": "exact",
"network": "base",
"mimeType": "application/json",
"resource": "https://datastand.dev/api/data/npm-vuln-digest",
"description": "The newest npm security advisories as machine-readable JSON: severity, CVSS score and vector, CWEs, affected packages, vulnerable ranges and first patched version. Merged from two GitHub Advisory Database orderings, most recently published and most recently revised, so a newly assigned CVSS or a widened vulnerable range reaches you even when the advisory is months old. Add ?since=<ISO-8601> for only what changed; an empty delta is refused free, so polling costs nothing until there is news.",
"maxAmountRequired": "20000",
"maxTimeoutSeconds": 120
}
],
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"since": "2026-08-31T10:12:22Z"
}
},
"output": {
"type": "json",
"example": {
"count": "integer",
"items": [
"..."
],
"dataset": "npm-vuln-digest",
"generated_at": "ISO-8601"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET",
"HEAD"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"since": {
"type": "string",
"description": "ISO-8601 date or timestamp. Returns only advisories whose updated_at is newer than this — normally the generated_at of your previous fetch. An empty delta is refused with a 400 and settles no payment, and so is a since earlier than the build's coverage.delta_complete_since, which would return a silently incomplete delta."
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
},
"x402Version": 1
}Accepts
The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.
Pay 0.02 USDC on Base to 0x470a…f4c6b. The signed payment is good for 2 minutes.
- Paid to
- 0x470a…f4c6b
- USD Coin contract
- 0x8335…02913
- Payment window
- 2 minutes
- As published
- 20000 smallest units
The catalog’s raw entry
[
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0x470a1b647d668d3820add26d70c8371557ff4c6b",
"amount": "20000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 120
}
]Extensions
{
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"since": "2026-08-31T10:12:22Z"
}
},
"output": {
"type": "json",
"example": {
"count": 110,
"items": [
{
"url": "https://github.com/advisories/GHSA-m6c8-jcw2-5r25",
"cwes": [
"CWE-79"
],
"cve_id": "CVE-2026-77615",
"ghsa_id": "GHSA-m6c8-jcw2-5r25",
"summary": "Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text",
"affected": [
{
"package": "org.opencastproject:opencast-engage-paella-player-7",
"first_patched": "19.7",
"vulnerable_range": "< 19.7"
},
{
"package": "org.opencastproject:opencast-engage-paella-player-7",
"first_patched": "20.2",
"vulnerable_range": ">= 20.0, < 20.2"
},
{
"package": "paella-core",
"first_patched": "1.50.6",
"vulnerable_range": "< 1.50.6"
}
],
"severity": "high",
"cvss_score": 8.7,
"updated_at": "2026-09-18T13:12:03Z",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"published_at": "2026-09-18T13:11:59Z"
}
],
"dataset": "npm-vuln-digest",
"coverage": {
"rows": 110,
"sources": [
{
"ok": true,
"rows": 100,
"sort": "published",
"error": null,
"truncated": true
},
{
"ok": true,
"rows": 100,
"sort": "updated",
"error": null,
"truncated": true
}
],
"checked_at": "2026-09-18T14:22:07.094Z",
"updated_to": "2026-09-18T13:12:03.000Z",
"published_to": "2026-09-18T13:11:59.000Z",
"updated_from": "2026-09-08T17:58:02.000Z",
"notes_omitted": [
"note",
"delta_complete_note",
"upstream_note"
],
"published_from": "2024-07-08T18:41:57.000Z",
"upstream_moved": true,
"delta_complete_known": true,
"delta_complete_since": "2026-09-08T20:51:58.000Z",
"notes_omitted_reason": "Prose only: sentences explaining the figures above. They are in this SKU's catalog description, and verbatim in the paid file. No fact is omitted here.",
"upstream_unchanged_since": null
},
"generated_at": "2026-09-18T14:22:07.094Z"
}
}
},
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET",
"HEAD"
],
"type": "string"
},
"queryParams": {
"type": "object",
"properties": {
"since": {
"type": "string",
"description": "ISO-8601 date or timestamp. Returns only advisories whose updated_at is newer than this — normally the generated_at of your previous fetch. An empty delta is refused with a 400 and settles no payment, and so is a since earlier than the build's coverage.delta_complete_since, which would return a silently incomplete delta."
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object"
}
}
}
}
}
}
}Provenance
- Seen in the source catalog
- —
- Last indexed by Roundhouse
- 2026-09-19 03:15Z
- Last enriched (probe, favicon, geo)
- 2026-09-19 03:45Z
- x402 version
- 2
- Max timeout
- 120s
- Liveness probe
- HTTP 402
Hand this page to an agent
Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.
GET api.roundhouseai.io/v0/endpoints
This endpoint's own trailing-30-day call count, as published by the upstream catalog and snapshotted daily. 31 snapshots so far. Verified volume counts only settlements with an on-chain EIP-3009 marker.
Show the promptHide the prompt
Using Roundhouse, look up the x402 service datastand.dev and tell me whether it is worth paying: what a call costs, whether the endpoint answered when last probed, and what its payment record actually shows. curl -s 'https://api.roundhouseai.io/v0/endpoints?q=datastand.dev' curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>' Then call it: read the price from the live 402 at https://datastand.dev/api/data/npm-vuln-digest, never from a cached figure, and pay with an x402 client. The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except /v0/unified* and /v0/endpoints. Mint a personal key for $0.01 at GET https://api.roundhouseai.io/v0/test/x402, or use an organization key from https://roundhouseai.io/dashboard/team. If you do not have Roundhouse tools or skills installed, read https://roundhouseai.io/skill.md first — it is the whole procedure.