Propagate CVE Impact Changes

Receive a source-bound, typed CVE change set for two revisions of the same pinned public GitHub lockfile or two explicitly caller-scoped exact inventories. Returns added/modified/removed observations with coverage and provenance limits; absence from a dependency tree is not proof a code vulnerability was remediated.

Seller-listed; delivery not independently established — A listing is not a completed purchase. The live HTTP 402 challenge supplies current payment terms.

Price preview: $0.05
Method: POST
Endpoint: https://market.561.group/v1/cve/propagation/diff
Seller: Seller not independently established
Source-rights state: not-declared
Offer NI: ni:///sha-256;gEBBHu3lTkoMe8IUxjNIz3CUt5R5TYAjpS2mWS72N6Y
Claim cell: ni:///sha-256;-Q6eEoLrneihBrgKPSCKcJKZRYiIuDRoyddBzAbvO9A
Operation law: ni:///sha-256;TeGWhKYIj3ZJhsiZ-gFToujyx708I2VLqqtBUYHK7uM

jsnode-package-vulnerability-triage
diff-cve-findings
software-supply-chain
ni:///sha-256;gEBBHu3lTkoMe8IUxjNIz3CUt5R5TYAjpS2mWS72N6Y
@red-cup-engineering/jsnode-package-vulnerability-triage-services-section

The seller offers this resource under the stated method and contract. The price is a preview, not payment authorization, settlement or a promise of delivery.

Request contract

{
  "maxBytes": 102400,
  "bodySchema": {
    "type": "object",
    "description": "Supply two independently produced CVE scan reports of the same public GitHub repository/lockfile path at distinct commits, or two exact/lockfile inventories with the same caller-declared scope; contradictory scopes are refused by the original supplier before a quote. Identifiers are caller-supplied, not attested.",
    "required": [
      "previousScan",
      "currentScan"
    ],
    "properties": {
      "previousScan": {
        "type": "object",
        "required": [
          "source",
          "findings",
          "coverage"
        ],
        "properties": {
          "format": {
            "const": "561-cve-applicability-v1"
          },
          "source": {
            "type": "object",
            "required": [
              "kind"
            ],
            "oneOf": [
              {
                "required": [
                  "kind",
                  "repository",
                  "commit",
                  "path"
                ],
                "properties": {
                  "kind": {
                    "const": "public-github-commit"
                  },
                  "repository": {
                    "type": "string",
                    "pattern": "^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$"
                  },
                  "commit": {
                    "type": "string",
                    "pattern": "^[A-Fa-f0-9]{40}$"
                  },
                  "path": {
                    "type": "string",
                    "pattern": "(?:^|/)package-lock\\.json$"
                  }
                }
              },
              {
                "required": [
                  "kind",
                  "scope"
                ],
                "properties": {
                  "kind": {
                    "enum": [
                      "npm-lockfile",
                      "exact-dependencies"
                    ]
                  },
                  "scope": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 256,
                    "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,255}$"
                  }
                }
              }
            ]
          },
          "findings": {
            "type": "array",
            "maxItems": 1024,
            "items": {
              "type": "object"
            }
          },
          "coverage": {
            "type": "object",
            "required": [
              "complete"
            ],
            "properties": {
              "complete": {
                "type": "boolean"
              }
            }
          }
        }
      },
      "currentScan": {
        "type": "object",
        "required": [
          "source",
          "findings",
          "coverage"
        ],
        "properties": {
          "format": {
            "const": "561-cve-applicability-v1"
          },
          "source": {
            "type": "object",
            "required": [
              "kind"
            ],
            "oneOf": [
              {
                "required": [
                  "kind",
                  "repository",
                  "commit",
                  "path"
                ],
                "properties": {
                  "kind": {
                    "const": "public-github-commit"
                  },
                  "repository": {
                    "type": "string",
                    "pattern": "^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$"
                  },
                  "commit": {
                    "type": "string",
                    "pattern": "^[A-Fa-f0-9]{40}$"
                  },
                  "path": {
                    "type": "string",
                    "pattern": "(?:^|/)package-lock\\.json$"
                  }
                }
              },
              {
                "required": [
                  "kind",
                  "scope"
                ],
                "properties": {
                  "kind": {
                    "enum": [
                      "npm-lockfile",
                      "exact-dependencies"
                    ]
                  },
                  "scope": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 256,
                    "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,255}$"
                  }
                }
              }
            ]
          },
          "findings": {
            "type": "array",
            "maxItems": 1024,
            "items": {
              "type": "object"
            }
          },
          "coverage": {
            "type": "object",
            "required": [
              "complete"
            ],
            "properties": {
              "complete": {
                "type": "boolean"
              }
            }
          }
        }
      }
    }
  },
  "example": {
    "method": "POST",
    "url": "https://market.561.group/v1/cve/propagation/diff",
    "headers": {
      "accept": "application/json",
      "content-type": "application/json"
    },
    "body": {
      "previousScan": {
        "format": "561-cve-applicability-v1",
        "source": {
          "kind": "public-github-commit",
          "repository": "example/project",
          "path": "package-lock.json",
          "commit": "0000000000000000000000000000000000000000"
        },
        "coverage": {
          "complete": true
        },
        "findings": []
      },
      "currentScan": {
        "format": "561-cve-applicability-v1",
        "source": {
          "kind": "public-github-commit",
          "repository": "example/project",
          "path": "package-lock.json",
          "commit": "1111111111111111111111111111111111111111"
        },
        "coverage": {
          "complete": true
        },
        "findings": []
      }
    }
  }
}

Unsigned request example (copy and run)

curl --include --request POST --header 'accept: application/json' --header 'content-type: application/json' --data-raw '{"previousScan":{"format":"561-cve-applicability-v1","source":{"kind":"public-github-commit","repository":"example/project","path":"package-lock.json","commit":"0000000000000000000000000000000000000000"},"coverage":{"complete":true},"findings":[]},"currentScan":{"format":"561-cve-applicability-v1","source":{"kind":"public-github-commit","repository":"example/project","path":"package-lock.json","commit":"1111111111111111111111111111111111111111"},"coverage":{"complete":true},"findings":[]}}' --url 'https://market.561.group/v1/cve/propagation/diff'

This request reads the seller's current HTTP response or 402 terms. It does not authorize or settle a payment. A buyer must independently approve current x402 terms.

Declared output

{
  "schema": {
    "type": "object",
    "required": [
      "format",
      "comparison",
      "coverage",
      "events"
    ],
    "properties": {
      "format": {
        "const": "561-cve-change-set-v1"
      },
      "comparison": {
        "type": "object",
        "required": [
          "qualified",
          "identity",
          "assurance"
        ],
        "properties": {
          "qualified": {
            "type": "boolean"
          },
          "identity": {
            "type": "string"
          },
          "assurance": {
            "type": "string"
          }
        }
      },
      "coverage": {
        "type": "object",
        "required": [
          "previousComplete",
          "currentComplete",
          "removalsAdmitted"
        ],
        "properties": {
          "previousComplete": {
            "type": "boolean"
          },
          "currentComplete": {
            "type": "boolean"
          },
          "removalsAdmitted": {
            "type": "boolean"
          },
          "caveat": {
            "type": "string"
          }
        }
      },
      "events": {
        "type": "array",
        "items": {
          "type": "object",
          "required": [
            "kind",
            "key"
          ],
          "properties": {
            "kind": {
              "type": "string"
            },
            "key": {
              "type": "string"
            },
            "finding": {
              "type": "object"
            },
            "prior": {
              "type": "object"
            }
          }
        }
      }
    }
  },
  "example": {
    "format": "561-cve-change-set-v1",
    "comparison": {
      "qualified": true,
      "identity": "github:example/project/package-lock.json",
      "assurance": "matching-caller-supplied-pinned-repository-identities"
    },
    "coverage": {
      "previousComplete": true,
      "currentComplete": true,
      "removalsAdmitted": true,
      "currentPathEvidenceComplete": null,
      "caveat": "A removed observation is not proof of code remediation or runtime exploitability"
    },
    "events": []
  }
}

View unsigned request example

Preview one-call atomic budget

How to buy with x402

Send the source's unsigned request. An admitted payable request receives HTTP 402 and a PAYMENT-REQUIRED header with its current amount, asset, network and payee.
Your x402 client signs the accepted terms and repeats the same request with PAYMENT-SIGNATURE.
A successful settled response contains the purchased result and its PAYMENT-RESPONSE receipt.

How x402 purchasing works

Source and machine access

The source SKU, claim cell and operation law above are the identities used by the machine catalogue and this page.