Explorer
Syncing—

TaintCheckService

taint-check

TaintCheck scans a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with one of: lockfile.url (a link to one public file on github.com, gitlab.com, bitbucket.org or their raw hosts; format taken from the filename), lockfile.format plus lockfile.content (the file pasted as a string), or components [{ecosystem,name,version}]. Formats: package.json (exact pins only), package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum. Returns per-dependency verdicts (malicious, vulnerable, suspicious, clean), a summary, and data_as_of. Data is OSV.dev plus the OpenSSF Malicious Packages feed; MAL- records are a distinct malicious verdict. options.since returns only newer advisories; options.heuristics adds typosquat signals. Errors are JSON objects with an error field; input with nothing to scan is a 400. Results vary with each supplier's snapshot freshness. Limits: GET /v1/capabilities.

Active Suppliers
3
of 3 ever configured
Service Info
Service ID
taint-check
Compute Units / Relay
50,000
Owner
pokt17…s08t
Active Applications
2
Relay Mining EMA
2 relays
Service Metadata Cardsource: on-chain metadata (LCD)
{10 items
"schema":"pocket-service-card/v1"
"description":"TaintCheck scans a dependency manifest for known-vulnerable and confirmed-malicious packages. POST /v1/scan with one of: lockfile.url (a link to one public file..."
"rpc_types":[1 item
0:{4 items
"type":"REST"
"intent":"expected"
"backend_hint":"taint-check container on :8080; mount at /"
"notes":"Only POST /v1/scan, GET /v1/version, GET /healthz, GET /v1/capabilities, and GET /v1/openapi.json are expected. Every response is a JSON object, including error..."
}
]
"apis":[2 items
0:"taint-check-api"
1:"dependency-audit"
]
"specs":[1 item
0:{5 items
"kind":"openapi"
"api":"taint-check-api"
"url":"https://agentdata.network/taint-check/openapi/v1/openapi.json"
"sha256":"c65532220b1fe57f9a8d34ad287b40e68770cbc2289ff677219924e70183ba82"
"notes":"The same document is served by the backend at GET /v1/openapi.json."
}
]
"access":"public"
"results":"variable"
"serving":{7 items
"backend":"The taint-check container (Node 22, no third-party dependencies; built from github.com/TheFeloniousMonk/portal-services, taint-check/backend) behind the HA Rela..."
"implementations":[1 item
0:"taint-check >= 1.1"
]
"docs":"https://agentdata.network/taint-check/operators"
"min_disk_gb":5
"min_ram_gb":2
"healthcheck":[3 items
0:{4 items
"rpc_type":"REST"
"request":{2 items
"path":"/v1/version"
"method":"GET"
}
"expect":{2 items
"json_path":"$.service"
"matches":"^taint-check$"
}
"notes":"Identity probe: pins the backend to this service so a wrong backend cannot be staked under this id."
}
1:{4 items
"rpc_type":"REST"
"request":{2 items
"path":"/healthz"
"method":"GET"
}
"expect":{2 items
"json_path":"$.status"
"matches":"^ok$"
}
"notes":"Readiness probe: 200 only once an OSV snapshot is loaded, so a supplier serving stale-empty data does not pass."
}
2:{4 items
"rpc_type":"REST"
"request":{3 items
"path":"/v1/scan"
"method":"POST"
"body":{2 items
"components":[1 item
0:{3 items
"ecosystem":"npm"
"name":"minimist"
"version":"1.2.0"
}
]
"options":{1 item
"heuristics":false
}
}
}
"expect":{2 items
"json_path":"$.findings[0].verdict"
"matches":"^vulnerable$"
}
"notes":"Functional probe: minimist 1.2.0 is permanently affected by a published prototype-pollution advisory, so the verdict is stable and deterministic. Cheap; a singl..."
}
]
"notes":"Every request is a POST JSON body to /v1/scan; scans finish in under a second, and fetching a lockfile.url adds up to 8 s. No rate limits to disable. SAGE opera..."
}
"docs":"https://agentdata.network/taint-check/"
"updated":"2026-10-17"
}