PayPerByte
POST x402.payperbyte.io/feeds/pkg-verdict
Why an agent can trust this route.
Sonar evidence is advisory. Paid delivery is shown as verified only when paid probes are available; otherwise route estimates use the unpaid handshake as a clearly labeled proxy.
Observed outcomes
Signed ALLOW/WARN/BLOCK on installing a package@version: OSV.dev malicious-corpus + typosquat distance + registry signals. Verify before you install.
Resource: x402.payperbyte.io/feeds/pkg-verdict
Network: eip155:8453 · Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · Pay to: 0xffFf4B8Da8C165B556326453446F6940C8AFE0DB
Payment methods: — · Last validation: —
{
"input": {
"body": {
"package": "left-pad",
"ecosystem": "npm"
},
"type": "http",
"method": "POST",
"bodyType": "json"
},
"output": {
"type": "json",
"example": {
"_note": "Illustrative response shape — not a live answer. ALLOW/WARN/BLOCK is a screening signal. The embedded EIP-712 receipt (domain chainId 421614 = Arbitrum Sepolia, a frozen signing namespace, not a settlement rail) proves who signed the exact answer bytes — not that the verdict is correct.",
"answer": {
"v": "pkg-verdict/v1",
"query": {
"package": "left-pad",
"version": null,
"ecosystem": "npm",
"version_requested": null
},
"score": 96,
"reasons": [
"illustrative — real answers cite the pv-v1 OSV.dev / typosquat / registry / known-bad signals judged"
],
"verdict": "ALLOW",
"methodology": "pv-v1"
},
"attestation": {
"domain": {
"name": "BYTE Library",
"chainId": 421614,
"version": "1"
},
"signer": "0x…",
"signature": "0x…",
"payloadHash": "0x…"
}
}
},
"paymentRequirements": [
{
"raw": {
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"payTo": "0xffFf4B8Da8C165B556326453446F6940C8AFE0DB",
"amount": "100000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"payTo": "0xffFf4B8Da8C165B556326453446F6940C8AFE0DB",
"scheme": "exact",
"network": "eip155:8453",
"amountAtomic": "100000"
}
]
}Source catalog records are retained separately from live endpoint observations. Sonar score, uptime, and latency are advisory metrics. CDP indexing is not inferred from validation.