Lines 1-57javascript
1process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
2import{a as Xe,b as l,c as nt}from"./chunk-QXX7A5CU.js";import{a as ot,b as q,c as ze,d as xe,e as at,i as st,j as Ie,k as Te,l as Ce,n as _,o as ct,p as
4 Swaps by: ${yr}`;import*as vt from"fs";import*as St from"os";import*as Pt from"path";var c=e=>e;function B(e){switch(e.type){case"solana":return e.base64;case"tron":return JSON.stringify(e);case"ton":return e.boc;case"filecoin":return JSON.stringify(e);case"evm":return JSON.stringify(e);default:return JSON.stringify(e)}}var p=(e,t)=>({schema:e,handler:async i=>{let r=e.input.parse(i),n=await t(r);return e.output.parse(n)}});import{z as ge}from"zod";var yt=c({name:"consent_check",description:"Check whether the MoonPay Terms of Use have been accepted. Throws if not accepted",input:ge. ...
5By using this CLI, you agree to:
8`),gt({agentId:t,tosVersion:"1.4",cliVersion:et}),{tosVersion:r.tosVersion,acceptedAt:r.acceptedAt}});var fr=Pt.join(St.homedir(),".config","moonpay","consent.json"),jt=p(yt,async
9`||a==="\r"?(process.stdin.setRawMode(!1),process.stdin.removeListener("data",o),process.stderr.write(`
10`),r.close(),t(n.trim())):a===""?(process.stdin.setRawMode(!1),r.close(),process.exit(0)):a==="\x7F"||a==="\b"?n=n.slice(0,-1):n+=a};process.stdin.on("data",o)})}function _r(e){let t=e.split(/\s+/);return t.length>=12&&t.length<=24&&Ct(e,qt)?"mnemonic":"key"}var $t=p(Tt,async e=>{if(e.mnemonic&&e.key)throw new Error("Provide either --mnemonic or --key, not both.");let t=e.mnemonic,i=e.key;if(!t&&!i){let s=await br("Paste your mnemonic or private key (hidden): ");if(!s)throw new Error("No input provided.");_r(s)==="mnemonic"?t=s:i=s}if(t){let s=t.trim().toLowerCase();if(!Ct(s,qt))throw new Err ...
11Run this command directly in your terminal: mp wallet export `+e.wallet);let t=_(e.wallet);if(t.type==="hardware")throw new Error(`Wallet "${t.name}" is a hardware wallet (${t.device}). There are no secrets to export \u2014 keys live on the device.`);let i=qe(t.name),r=i.includes(
12Wallet "${t.name}" is an imported single-key wallet.
13The --chain flag is only meaningful for HD wallets. Exporting the key as-is.
15`),process.stderr.write(`Private key for "${t.name}":
17`),process.stderr.write(` ${i}
19`),{exported:!0};let{moonpay:n}=await import("./client-444SZUFF.js"),s=(await n.chain.retrieve({chain:e.chain})).keyFamily,{privateKey:a,address:d}=at(i,s),u=Pr(a,s);return process.stderr.write(`
20Derived ${e.chain} private key for "${t.name}":
22`),process.stderr.write(` Chain: ${e.chain}${e.chain!==s?` (${s})`:""}
23`),process.stderr.write(` Address: ${d}
24`),process.stderr.write(` Private key: ${u}
26`),{exported:!0}}return r?(process.stderr.write(`
27Mnemonic for "${t.name}":
29`),process.stderr.write(` ${i}
31`),process.stderr.write(`Write this down and store it securely.
33`)):(process.stderr.write(`
34Private key for "${t.name}":
36`),process.stderr.write(` ${i}
38`)),{exported:!0}});function jr(){return{async connect(){let{connectLedger:e}=await import("./ledger-M7MMN44T.js");await e()},async disconnect(){let{
39`),await new Promise(T=>setTimeout(T,5e3)),o=await l.swaps.transaction.build(n)}let a=B(o.transaction);if(o.transaction.type==="ton"){let m=JSON.parse(a);m.token=e.from.token,a=JSON.stringify(m)}let{transaction:d}=await b.handler({wallet:t.name,chain:e.from.chain,transaction:a}),u=await l.transaction.send({transaction:d,message:o.message,chain:e.from.chain});if(!u.signature)throw new Error(`Transaction send failed: ${u.message}`);try{await l.transaction.register({transactionId:o.transactionId,transactionHash:u.signature,chain:e.from.chain})}catch{}return{signature:u.signature,message:o.message ...
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-3PXNCIVG.jsView on unpkg · L1 CriticalWallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/chunk-3PXNCIVG.jsView on unpkg · L1 CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-3PXNCIVG.jsView on unpkg · L1 HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-3PXNCIVG.jsView on unpkg · L22 40Run: npm i -g @moonpay/cli --include=optional`;async function Di(){try{let[e,t,i]=await Promise.all([import("./esm-UGHAPFP3.js"),import("./client-42E5L4GY.js"),import("./esm-63TCHIGX.js")]);return{...e,...
44Once you receive the code, give it to your agent or run: mp verify --email ${e.email} --code <code>`}});import*as Mi from"fs";import*as Hi from"os";import*as zi from"path";V();import{z as de}from"zod";var Bi
45`),await new Promise(y=>setTimeout(y,5e3))}let o=B(n.transaction),{transaction:s}=await b.handler({wallet:i.name,chain:t,transaction:o}),a=await l.transaction.send({transaction:s,message:`Buy ${e.size} shares at ${e.price}`,chain:t});if(!a.signature)throw new Error(`Transaction send failed: ${a.message}`);return{signature:a.signature,message:`Bought ${e.size} shares at ${e.price} on ${e.provider}`}});import{exec as xn}from"child_process";import{z as N}from"zod";var Qi=c({name:"prediction-market_position_sell",description:"Sell shares of a prediction market outcome. For Kalshi: signs + broadcas ...
46`);let n=await l.commerce.checkout.start({store:e.store,cartId:e.cartId,wallet:r,chain:e.chain,email:e.email,firstName:e.firstName,lastName:e.lastName,address:e.address,city:e.city,postalCode:e.postalCode,country:e.country});process.stderr.write(`Signing transaction...
47`);let{transaction:o}=await b.handler({wallet:i.name,chain:t,transaction:n.serializedTransaction});process.stderr.write(`Submitting payment...
48`);let s=await l.commerce.checkout.pay({signedTransaction:o,transactionToken:n.transactionToken,rateToken:n.rateToken,paylinkId:n.paylinkId,requestAmount:n.requestAmount,currency:n.currency,chain:n.chain,sender:n.sender,recipient:n.recipient,addressLookupTableAccounts:n.addressLookupTableAccounts});return{transactionSignature:s.transactionSignature,status:s.status,redirectUrl:s.redirectUrl,message:s.message}});import{z as W}from"zod";var rr=c({name:"card_wallet_link",description:"Delegate a local Solana wallet to MoonCard (Baanx) for card funding. Runs the full 4-step dance locally: builds an ...
49`)}var nr=p(rr,async e=>{let t=await f.handler({wallet:e.wallet}),i=t.addresses.solana;if(!i)throw new Error(`Wallet "${t.name}" has no Solana address.`);process.stderr.write(`Building SPL Approve transaction...
50`);let r=await l.card.delegation.approve.transaction.build({wallet:i,chain:"solana",currency:e.currency,amount:e.amount});process.stderr.write(`Signing Approve transaction...
51`);let{transaction:n}=await b.handler({wallet:t.name,chain:"solana",transaction:r.transaction});process.stderr.write(`Broadcasting Approve transaction...
52`);let o=await l.transaction.send({transaction:n,message:`Approve ${e.amount} ${e.currency.toUpperCase()} for MoonCard`,chain:"solana"});if(!o.signature)throw new Error(`Approve broadcast failed: ${o.message}`);let s=o.signature;process.stderr.write(`Fetching delegation token...
53`);let a=await l.card.delegation.token.retrieve({chain:"solana",faucet:!1,address:null}),d=a.environment==="production"?"baanx.com":"dev.baanx.com",u=An({address:i,domain:d,uri:`https://${d}`,statement:"Prove address ownership",chainId:a.chainId,nonce:a.nonce,issuedAt:new Date().toISOString()});process.stderr.write(`Signing SIWS ownership message...
54`);let{signature:m}=await w.handler({wallet:t.name,chain:"solana",message:u,typedData:null});return process.stderr.write(`Registering wallet with MoonCard...
55`),await l.card.wallet.link({wallet:i,chain:"solana",currency:e.currency,amount:e.amount,txHash:s,signature:m,sigMessage:u,token:a.token}),{success:!0,address:i,txHash:s}});import{z as re}from"zod";var or=c({name:"card_wallet_unlink",description:"Remove a delegated Solana wallet from MoonCard. Builds a Revoke tx, signs and broadcasts locally. The wallet disappears from `mp card wallet list` once the revoke confirms.",input:re.object({wallet:re.string().describe("Local wallet name to un-delegate"),currency:re.enum(["usdc","xo"])}),output:re.object({success:re.literal(!0),address:re.string(),txH ...
56`);let r=await l.card.wallet.unlink({wallet:i,chain:"solana",currency:e.currency});process.stderr.write(`Signing Revoke transaction...
57`);let{transaction:n}=await b.handler({wallet:t.name,chain:"solana",transaction:r.transaction});process.stderr.write(`Broadcasting Revoke transaction...
Long lines were clipped for display.