Tolca / pkg-check

Is this package safe to install? One call, one verdict: safe / caution / avoid, with a score, concrete reasons (known vulnerabilities from OSV, deprecation, abandonment, adoption, install scripts, typosquat signals) and a one-line recommendation. Input: name, ecosystem (npm | PyPI), optional version.

Price: $0.02 USDC per call (x402 v2, Base).
This endpoint takes POST with a JSON body. A plain GET shows this help.

Try it (Node):
  npm i @x402/fetch @x402/evm viem
  import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
  import { ExactEvmScheme } from "@x402/evm";
  import { privateKeyToAccount } from "viem/accounts";
  const c = new x402Client().register("eip155:8453", new ExactEvmScheme(privateKeyToAccount(KEY)));
  const f = wrapFetchWithPayment(fetch, c);
  const r = await f("https://tolca.tonbot.ca/v1/pkg-check", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({"name":"lodash","ecosystem":"npm","version":"4.17.15"}) });

Schema and examples: https://tolca.tonbot.ca/.well-known/agent.json
On-chain identity (ERC-8004): agentId 100539 on eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432