{
  "openapi": "3.0.1",
  "info": {
    "title": "Package Sus Detector: npm & PyPI Slopsquat Check",
    "description": "Check npm and PyPI packages before you install them: hallucinated (slopsquatted) names, typosquats, known vulnerabilities (OSV), deprecated or abandoned packages. Paste a package.json, requirements.txt or lockfile; CI gate and GitHub Actions ready. Built for AI coding agents.",
    "version": "0.2",
    "x-build-id": "SBLCwf6OhX4eRdQG4"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/stormy251~package-sus-detector/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-stormy251-package-sus-detector",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/stormy251~package-sus-detector/runs": {
      "post": {
        "operationId": "runs-sync-stormy251-package-sus-detector",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/stormy251~package-sus-detector/run-sync": {
      "post": {
        "operationId": "run-sync-stormy251-package-sus-detector",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "properties": {
          "packages": {
            "title": "Packages to check",
            "type": "array",
            "description": "Package names, one per entry. Optional version after @ (npm: lodash@4.17.15) or == (PyPI: django==2.2.0). Prefix with npm: or pypi: to mix ecosystems; entries without a prefix use the Default ecosystem below. Without a version the latest release is checked.",
            "items": {
              "type": "string"
            }
          },
          "ecosystem": {
            "title": "Default ecosystem",
            "enum": [
              "npm",
              "pypi"
            ],
            "type": "string",
            "description": "Ecosystem for entries in 'Packages to check' that have no npm: / pypi: prefix.",
            "default": "npm"
          },
          "packageJson": {
            "title": "package.json contents (optional)",
            "type": "string",
            "description": "Paste a package.json. dependencies, optionalDependencies, peerDependencies and (optionally) devDependencies are checked. Exact pins are checked at that version; ranges are checked at the latest release and the range is echoed back. Git/file/workspace specifiers are skipped."
          },
          "requirementsTxt": {
            "title": "requirements.txt contents (optional)",
            "type": "string",
            "description": "Paste a requirements.txt. Lines pinned with == are checked at that version; other specifiers are checked at the latest release. Options (-r, -e), URLs, VCS and local paths are skipped."
          },
          "lockfile": {
            "title": "Lockfile contents (optional)",
            "type": "string",
            "description": "Paste a package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, poetry.lock, uv.lock or Pipfile.lock. The format is detected automatically and every entry is checked at its exact locked version (including transitive dependencies). Workspace links and git/file/URL sources are skipped. Tip: a full lockfile can hold hundreds of packages; to check only what a pull request changed, also set 'Base lockfile'."
          },
          "baseLockfile": {
            "title": "Base lockfile to diff against (optional)",
            "type": "string",
            "description": "The same kind of lockfile from your main branch. When set, only packages that are new or changed in 'Lockfile contents' are checked and charged, which keeps CI runs cheap."
          },
          "includeDevDependencies": {
            "title": "Include devDependencies",
            "type": "boolean",
            "description": "When a package.json, package-lock.json or Pipfile.lock is pasted, also check dev dependencies. (Not applied to yarn.lock, pnpm-lock.yaml, poetry.lock or uv.lock, which do not mark dev entries in a way that can be filtered.)",
            "default": true
          },
          "projectLicenseType": {
            "title": "Your project's licence type (optional)",
            "enum": [
              "unspecified",
              "permissive",
              "proprietary",
              "weak-copyleft",
              "strong-copyleft"
            ],
            "type": "string",
            "description": "If set, each package gets a licence compatibility hint (likely_compatible / review_needed) relative to this type. A convenience signal, not legal advice.",
            "default": "unspecified"
          },
          "maxPackages": {
            "title": "Max packages per run",
            "minimum": 1,
            "maximum": 5000,
            "type": "integer",
            "description": "Safety cap on how many packages are checked in one run (hard maximum 5000). Extra packages are skipped and listed in the summary notes.",
            "default": 500
          },
          "failOn": {
            "title": "CI gate: fail on",
            "enum": [
              "never",
              "caution",
              "suspicious",
              "not_found"
            ],
            "type": "string",
            "description": "Adds a pass/fail decision to the run summary (summary.gate, with exitCode 0 or 1 and a ready-made markdown report) so a CI job can block a pull request. The Actor run itself always finishes normally; your CI step reads gate.exitCode. 'never' (default) only reports. 'caution' fails on caution, suspicious or not_found. 'suspicious' fails on suspicious or not_found. 'not_found' fails only on names that are not registered.",
            "default": "never"
          },
          "failOnRiskScore": {
            "title": "CI gate: fail at risk score (optional)",
            "minimum": 1,
            "maximum": 100,
            "type": "integer",
            "description": "Also fail the gate when any package's 0-100 risk score is at or above this number. Leave empty to ignore."
          },
          "newPackageDays": {
            "title": "'New package' threshold (days)",
            "minimum": 1,
            "maximum": 365,
            "type": "integer",
            "description": "Packages first published within this many days are flagged as new, and feed the slopsquat signal.",
            "default": 30
          },
          "staleDays": {
            "title": "'Stale' threshold (days)",
            "minimum": 90,
            "maximum": 3650,
            "type": "integer",
            "description": "Packages whose last release is older than this are flagged as stale (twice this value is flagged abandoned).",
            "default": 730
          },
          "includeDownloads": {
            "title": "Look up download counts",
            "type": "boolean",
            "description": "Weekly downloads from api.npmjs.org / pypistats.org. Disable for speed; usage-based signals are then skipped.",
            "default": true
          },
          "includeVulnerabilities": {
            "title": "Look up known vulnerabilities (OSV)",
            "type": "boolean",
            "description": "Query api.osv.dev for advisories affecting the checked version, including OSV's malicious-package feed.",
            "default": true
          },
          "includeDepsDev": {
            "title": "Include deps.dev data",
            "type": "boolean",
            "description": "Adds deps.dev version metadata (licences, advisory count, project status, provenance flags).",
            "default": true
          },
          "includeEol": {
            "title": "Check end-of-life status",
            "type": "boolean",
            "description": "For packages that endoflife.date tracks (for example django, react, angular), report whether the release line is end-of-life.",
            "default": true
          },
          "includeScorecard": {
            "title": "Include OpenSSF Scorecard summary",
            "type": "boolean",
            "description": "Adds the OpenSSF Scorecard score, stars and forks of the linked source repository from deps.dev (one extra request per package).",
            "default": false
          },
          "includeSummaryItem": {
            "title": "Add summary item to dataset",
            "type": "boolean",
            "description": "Append a final dataset item (recordType 'summary') with verdict counts and the worst offenders. The summary is always stored in the key-value store under SUMMARY. The summary item is not charged.",
            "default": true
          },
          "concurrency": {
            "title": "Concurrency",
            "minimum": 1,
            "maximum": 16,
            "type": "integer",
            "description": "Packages checked in parallel (1-16). Per-host rate limiting is applied regardless.",
            "default": 8
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_UNBLOCKER_UNITS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}