HALOWERKPaketwerk
package match
Resolves a package to the source projects it declares, with the provenance of each link stated. This is the honest way to answer whether two packages belong together: names repeat across ecosystems and mean different things there, and that gap is exactly what dependency confusion attacks aim at.
POST https://paket.halowerk.com/v1/package-matchEingaben
| Feld | Typ | Pflicht | Beschreibung |
|---|---|---|---|
| system | string | Ja | |
| name | string | Ja | |
| version | string | Nein | Defaults to the registry default version. |
| compare_system | string | Nein | Second package to compare against. |
| compare_name | string | Nein |
Vollständiges Eingabeschema anzeigen
{
"type": "object",
"required": [
"system",
"name"
],
"additionalProperties": false,
"properties": {
"system": {
"type": "string",
"enum": [
"npm",
"pypi",
"maven",
"go",
"cargo",
"nuget",
"rubygems"
]
},
"name": {
"type": "string",
"minLength": 1,
"maxLength": 300
},
"version": {
"type": "string",
"maxLength": 60,
"description": "Defaults to the registry default version."
},
"compare_system": {
"type": "string",
"enum": [
"npm",
"pypi",
"maven",
"go",
"cargo",
"nuget",
"rubygems"
],
"description": "Second package to compare against."
},
"compare_name": {
"type": "string",
"maxLength": 300
}
}
}Veröffentlichtes Eingabebeispiel
{
"system": "npm",
"name": "express",
"compare_system": "pypi",
"compare_name": "requests"
}Ergebnis & Dokumentation
Maschinenlesbare Dokumentation dieses Hubs
Quelle dieser Seite: der veröffentlichte HALOWERK-Katalog. Stand: 2026-11-01, 15:19 UTC.
Weitere Endpunkte dieses Hubs
- Paketwerk0,003 USDC
artifact hash
POSThttps://paket.halowerk.com/v1/artifact-hashTakes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, th
- Paketwerk0,005 USDC
dependency bloat
POSThttps://paket.halowerk.com/v1/dependency-bloatScores how much a package costs to depend on, using the resolved graph rather than a guess. Four measurements: the number of transitive nodes, the maximum depth, how many packages appear at more than one version, and the fan-out of the root
- Paketwerk0,005 USDC
dependency confusion
POSThttps://paket.halowerk.com/v1/dependency-confusionTakes the names your organisation publishes internally and checks each against the public registry of the same ecosystem. Three findings, kept apart because they call for different actions. Name is free: nobody has taken it, the door is ope