TaintCheck scans a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with either a raw lockfile (lockfile.format one of package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum; lockfile.content as a string) or a pre-parsed components array of {ecosystem,name,version}. Returns a JSON object: per-dependency findings each with a verdict of malicious, vulnerable, suspicious, or clean, a summary, and the data_as_of timestamp of the backing snapshot. Data is OSV.dev plus the OpenSSF Malicious Packages feed; MAL- records surface as a distinct malicious verdict, never folded into CVE severity. Optional options.since returns only advisories newer than a timestamp (monitor mode); options.heuristics adds typosquat, install-script, and dormancy signals. Errors are JSON objects with an error field. Findings vary by each supplier's snapshot freshness and converge as mirrors sync. Limits (body size, component count) are reported by GET /v1/capabilities.
