PackageIntel

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/fiatdock-com/json-schema/fiatdock-com-package-intel-schema.json",
  "title": "PackageIntel",
  "description": "Paid. npm / PyPI package safety and maintenance.",
  "x-generated": "2026-11-07",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/fiatdock-com-openapi.json#/components/schemas/PackageIntel",
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "enum": [
        "npm",
        "pypi"
      ],
      "description": "The registry: npm or pypi"
    },
    "name": {
      "type": "string",
      "description": "The package name as the registry spells it"
    },
    "version": {
      "type": "string",
      "description": "The version analysed (the latest when none was named)"
    },
    "latestVersion": {
      "type": [
        "string",
        "null"
      ],
      "description": "The registry's latest release (npm's `latest` dist-tag; PyPI's current version)"
    },
    "isLatest": {
      "type": [
        "boolean",
        "null"
      ],
      "description": "True when the analysed version is the latest"
    },
    "description": {
      "type": [
        "string",
        "null"
      ],
      "description": "The package's own one-line description"
    },
    "license": {
      "type": [
        "string",
        "null"
      ],
      "description": "The declared licence (SPDX expression where given), or null when none is declared"
    },
    "repository": {
      "type": [
        "string",
        "null"
      ],
      "description": "The declared source repository as an https URL, or null"
    },
    "homepage": {
      "type": [
        "string",
        "null"
      ],
      "description": "The declared homepage, or null"
    },
    "deprecated": {
      "type": [
        "string",
        "null"
      ],
      "description": "npm: the deprecation message of this version; PyPI: 'yanked: <reason>' when the release is yanked; null otherwise"
    },
    "publishedAt": {
      "type": [
        "string",
        "null"
      ],
      "description": "ISO time the analysed version was published (null when the registry could not be read for dates)"
    },
    "latestPublishedAt": {
      "type": [
        "string",
        "null"
      ],
      "description": "ISO time the latest release was published"
    },
    "daysSinceLatestRelease": {
      "type": [
        "number",
        "null"
      ],
      "description": "Whole days since the latest release was published"
    },
    "downloadsLastWeek": {
      "type": [
        "number",
        "null"
      ],
      "description": "Downloads in the last 7 days (npm: api.npmjs.org; PyPI: pypistats.org last_week); null when the counter did not answer"
    },
    "dependencyCount": {
      "type": [
        "number",
        "null"
      ],
      "description": "Runtime dependencies this version declares (npm `dependencies`; PyPI `requires_dist` entries not tied to an extra); null when undeclared metadata makes it unknown"
    },
    "maintainersCount": {
      "type": [
        "number",
        "null"
      ],
      "description": "Accounts allowed to publish (npm's current maintainers; PyPI's owners and maintainers)"
    },
    "vulnerabilities": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "The OSV id (GHSA-…, PYSEC-…, MAL-…)"
          },
          "aliases": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Other ids of the same flaw (CVE-…, the other database's id)"
          },
          "summary": {
            "type": [
              "string",
              "null"
            ],
            "description": "The advisory's own one-line summary"
          },
          "severity": {
            "type": [
              "string",
              "null"
            ],
            "description": "LOW / MODERATE / HIGH / CRITICAL as the advisory's own database labels it; null when it gives none"
          },
          "cvssVector": {
            "type": [
              "string",
              "null"
            ],
            "description": "The advisory's CVSS vector string, when it has one"
          },
          "fixedIn": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Versions the advisory says fix it (empty = no fixed release named)"
          },
          "published": {
            "type": [
              "string",
              "null"
            ],
            "description": "When the advisory was published"
          },
          "url": {
            "type": "string",
            "description": "The advisory on osv.dev"
          }
        },
        "required": [
          "id",
          "aliases",
          "summary",
          "severity",
          "cvssVector",
          "fixedIn",
          "published",
          "url"
        ]
      },
      "description": "Known vulnerabilities OSV.dev lists for THIS version, most severe first"
    },
    "vulnerabilityCount": {
      "type": "number",
      "description": "Number of vulnerabilities listed (the same flaw published by two databases counts once)"
    },
    "osvRecords": {
      "type": "number",
      "description": "OSV records returned before the same flaw from two databases was folded into one row"
    },
    "riskFlags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Flags from a stated rule list (see note): malicious_package, deprecated, yanked, known_vulnerabilities, high_or_critical_vulnerability, newer_version_available, no_release_in_2_years, very_low_downloads, no_license, no_repository"
    },
    "source": {
      "type": "string",
      "description": "Where the data came from"
    },
    "asOf": {
      "type": "string",
      "description": "ISO time of the oldest upstream read this answer used"
    },
    "note": {
      "type": "string",
      "description": "How to read the answer, its rules and limits, and the data attribution"
    },
    "defaulted": {
      "type": "object",
      "properties": {
        "field": {
          "type": "string"
        },
        "to": {
          "type": "string"
        },
        "value": {
          "type": "string"
        },
        "note": {
          "type": "string"
        }
      },
      "required": [
        "field",
        "to",
        "value",
        "note"
      ],
      "description": "Present only when the body named no field: which package the answer is for, and why"
    }
  },
  "required": [
    "ecosystem",
    "name",
    "version",
    "latestVersion",
    "isLatest",
    "description",
    "license",
    "repository",
    "homepage",
    "deprecated",
    "publishedAt",
    "latestPublishedAt",
    "daysSinceLatestRelease",
    "downloadsLastWeek",
    "dependencyCount",
    "maintainersCount",
    "vulnerabilities",
    "vulnerabilityCount",
    "osvRecords",
    "riskFlags",
    "source",
    "asOf",
    "note"
  ]
}