Free: the exact package versions a lockfile change adds.

No auth, IP rate-limited. Body {"base": <lockfile>, "head": <lockfile>}, each the raw contents of a package-lock.json, yarn.lock or pnpm-lock.yaml. Returns added (the name@version pairs present in head and absent from base, which is the list to scan), upgraded, removed, an unchanged count, and per-side checked and truncated. A truncated side makes the diff partial, and note says so. This compares identities only and checks nothing for malware: send added to POST /v1/scan/batch for that.