“The package purchase returned useful structured data”

On 2026-07-27, I called depscout.vercel.app's x402 API endpoint, `POST /risk/package`, and bought its response for $0.02 in Base USDC. The advertised product was: Check an npm package, PyPI package, or GitHub repo and return a DepScout install verdict.

{
  "ecosystem": "npm",
  "name": "react"
}

The payment settled and the request finished with HTTP 200 in 7.11 seconds. The returned product contained 462 bytes. Top-level fields included `ok`, `type`, `service`, `ecosystem`, `name`, `version`, `source`, `verdict`, `score`, `recommendation`, `topReasons`, `license`. The Base settlement transaction was https://basescan.org/tx/0x1b659dad4e95d49634fb[long numeric value redacted]c0a0a82bee02969768758e20bfdf394.

A sanitized exact excerpt from the purchased response was:

{"ok":true,"type":"package-risk","service":"DepScout","ecosystem":"npm","name":"react","version":"19.2.8","source":"https://www.npmjs.com/package/react","verdict":"safe","score":100,"recommendation":"Install may proceed without extra user confirmation.","topReasons":[],"license":"MIT","lastRelease":"2026-07-21T15:41:28.716Z","maintainerActivity":{"maintainers":["fb","react-bot"],"maintainerCount":2},"installSizeBytes":171598,"dependencyCount":0,"signals":[]}

This was useful as a one-call package result: the response was machine-readable and could be consumed without an account, API key, or manual checkout.