Lines 1-57javascript
1process.noDeprecation = true; import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
2import{a as ct,b as l,c as yt}from"./chunk-WQ5NO24E.js";import{a as ht,b as A,c as Je,d as $e,e as ft,i as gt,j as Ae,k as De,l as Ue,n as k,o as bt,p as
4 Swaps by: ${Lr}`;import*as At from"fs";import*as Dt from"os";import*as Ut from"path";var p=e=>e;function U(e){switch(e.type){case"solana":return e.base64;case"tron":return JSON.stringify(e);case"ton":return e.boc;case"filecoin":return JSON.stringify(e);case"evm":return JSON.stringify(e);default:return JSON.stringify(e)}}var c=(e,t)=>({schema:e,handler:async i=>{let r=e.input.parse(i),n=await t(r);return e.output.parse(n)}});import{z as we}from"zod";var Pt=p({name:"consent_check",description:"Check whether the MoonPay Terms of Use have been accepted. Throws if not accepted",input:we. ...
5By using this CLI, you agree to:
8`),qt({agentId:t,tosVersion:"1.4",cliVersion:dt}),{tosVersion:r.tosVersion,acceptedAt:r.acceptedAt}});var Nr=Ut.join(Dt.homedir(),".config","moonpay","consent.json"),Et=c(Pt,async
9`||s==="\r"?(process.stdin.setRawMode(!1),process.stdin.removeListener("data",o),process.stderr.write(`
10`),r.close(),t(n.trim())):s===""?(process.stdin.setRawMode(!1),r.close(),process.exit(0)):s==="\x7F"||s==="\b"?n=n.slice(0,-1):n+=s};process.stdin.on("data",o)})}function Hr(e){let t=e.split(/\s+/);return t.length>=12&&t.length<=24&&Nt(e,Bt)?"mnemonic":"key"}var Mt=c(Ot,async e=>{if(e.mnemonic&&e.key)throw new Error("Provide either --mnemonic or --key, not both.");let t=e.mnemonic,i=e.key;if(!t&&!i){let a=await Mr("Paste your mnemonic or private key (hidden): ");if(!a)throw new Error("No input provided.");Hr(a)==="mnemonic"?t=a:i=a}if(t){let a=t.trim().toLowerCase();if(!Nt(a,Bt))throw new Err ...
11Run this command directly in your terminal: mp wallet export `+e.wallet);let t=k(e.wallet);if(t.type==="hardware")throw new Error(`Wallet "${t.name}" is a hardware wallet (${t.device}). There are no secrets to export \u2014 keys live on the device.`);let i=Ee(t.name),r=i.includes(
12Wallet "${t.name}" is an imported single-key wallet.
13The --chain flag is only meaningful for HD wallets. Exporting the key as-is.
15`),process.stderr.write(`Private key for "${t.name}":
17`),process.stderr.write(` ${i}
19`),{exported:!0};let{moonpay:n}=await import("./client-DD7DO5KC.js"),a=(await n.chain.retrieve({chain:e.chain})).keyFamily,{privateKey:s,address:d}=ft(i,a),m=Kr(s,a);return process.stderr.write(`
20Derived ${e.chain} private key for "${t.name}":
22`),process.stderr.write(` Chain: ${e.chain}${e.chain!==a?` (${a})`:""}
23`),process.stderr.write(` Address: ${d}
24`),process.stderr.write(` Private key: ${m}
26`),{exported:!0}}return r?(process.stderr.write(`
27Mnemonic for "${t.name}":
29`),process.stderr.write(` ${i}
31`),process.stderr.write(`Write this down and store it securely.
33`)):(process.stderr.write(`
34Private key for "${t.name}":
36`),process.stderr.write(` ${i}
38`)),{exported:!0}});function Gr(){return{async connect(){let{connectLedger:e}=await import("./ledger-INSE4YEG.js");await e()},async disconnect(){let{
39`),await new Promise(S=>setTimeout(S,5e3)),o=await l.swaps.transaction.build(n)}let s=U(o.transaction);if(o.transaction.type==="ton"){let u=JSON.parse(s);u.token=e.from.token,s=JSON.stringify(u)}let{transaction:d}=await g.handler({wallet:t.name,chain:e.from.chain,transaction:s}),m=await l.transaction.send({transaction:d,message:o.message,chain:e.from.chain});if(!m.signature)throw new Error(`Transaction send failed: ${m.message}`);try{await l.transaction.register({transactionId:o.transactionId,transactionHash:m.signature,chain:e.from.chain})}catch{}return{signature:m.signature,message:o.message ...
CriticalCredential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-OEDC4S6Y.jsView on unpkg · L1 CriticalWallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/chunk-OEDC4S6Y.jsView on unpkg · L1 CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/chunk-OEDC4S6Y.jsView on unpkg · L1 HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-OEDC4S6Y.jsView on unpkg · L22 40Run: npm i -g @moonpay/cli --include=optional`;async function Gi(){try{let[e,t,i]=await Promise.all([import("./esm-UGHAPFP3.js"),import("./client-42E5L4GY.js"),import("./esm-63TCHIGX.js")]);return{...e,...
44Once you receive the code, give it to your agent or run: mp verify --email ${e.email} --code <code>`}});import*as ir from"fs";import*as rr from"os";import*as nr from"path";G();import{z as ye}from"zod";var tr
45`),await new Promise(y=>setTimeout(y,5e3))}let o=U(n.transaction),{transaction:a}=await g.handler({wallet:i.name,chain:t,transaction:o}),s=await l.transaction.send({transaction:a,message:`Buy ${e.size} shares at ${e.price}`,chain:t});if(!s.signature)throw new Error(`Transaction send failed: ${s.message}`);return{signature:s.signature,message:`Bought ${e.size} shares at ${e.price} on ${e.provider}`}});import{exec as io}from"child_process";import{z as M}from"zod";var ur=p({name:"prediction-market_position_sell",description:"Sell shares of a prediction market outcome. For Kalshi: signs + broadcas ...
46`);let n=await l.commerce.checkout.start({store:e.store,cartId:e.cartId,wallet:r,chain:e.chain,email:e.email,firstName:e.firstName,lastName:e.lastName,address:e.address,city:e.city,postalCode:e.postalCode,country:e.country});process.stderr.write(`Signing transaction...
47`);let{transaction:o}=await g.handler({wallet:i.name,chain:t,transaction:n.serializedTransaction});process.stderr.write(`Submitting payment...
48`);let a=await l.commerce.checkout.pay({signedTransaction:o,transactionToken:n.transactionToken,rateToken:n.rateToken,paylinkId:n.paylinkId,requestAmount:n.requestAmount,currency:n.currency,chain:n.chain,sender:n.sender,recipient:n.recipient,addressLookupTableAccounts:n.addressLookupTableAccounts});return{transactionSignature:a.transactionSignature,status:a.status,redirectUrl:a.redirectUrl,message:a.message}});import{z as K}from"zod";var br=p({name:"card_wallet_link",description:"Delegate a local Solana wallet to MoonCard (Baanx) for card funding. Runs the full 4-step dance locally: builds an ...
49`)}var _r=c(br,async e=>{let t=await f.handler({wallet:e.wallet}),i=t.addresses.solana;if(!i)throw new Error(`Wallet "${t.name}" has no Solana address.`);process.stderr.write(`Building SPL Approve transaction...
50`);let r=await l.card.delegation.approve.transaction.build({wallet:i,chain:"solana",currency:e.currency,amount:e.amount});process.stderr.write(`Signing Approve transaction...
51`);let{transaction:n}=await g.handler({wallet:t.name,chain:"solana",transaction:r.transaction});process.stderr.write(`Broadcasting Approve transaction...
52`);let o=await l.transaction.send({transaction:n,message:`Approve ${e.amount} ${e.currency.toUpperCase()} for MoonCard`,chain:"solana"});if(!o.signature)throw new Error(`Approve broadcast failed: ${o.message}`);let a=o.signature;process.stderr.write(`Fetching delegation token...
53`);let s=await l.card.delegation.token.retrieve({chain:"solana",faucet:!1,address:null}),d=s.environment==="production"?"baanx.com":"dev.baanx.com",m=po({address:i,domain:d,uri:`https://${d}`,statement:"Prove address ownership",chainId:s.chainId,nonce:s.nonce,issuedAt:new Date().toISOString()});process.stderr.write(`Signing SIWS ownership message...
54`);let{signature:u}=await P.handler({wallet:t.name,chain:"solana",message:m,typedData:null});return process.stderr.write(`Registering wallet with MoonCard...
55`),await l.card.wallet.link({wallet:i,chain:"solana",currency:e.currency,amount:e.amount,txHash:a,signature:u,sigMessage:m,token:s.token}),{success:!0,address:i,txHash:a}});import{z as ae}from"zod";var kr=p({name:"card_wallet_unlink",description:"Remove a delegated Solana wallet from MoonCard. Builds a Revoke tx, signs and broadcasts locally. The wallet disappears from `mp card wallet list` once the revoke confirms.",input:ae.object({wallet:ae.string().describe("Local wallet name to un-delegate"),currency:ae.enum(["usdc","xo"])}),output:ae.object({success:ae.literal(!0),address:ae.string(),txH ...
56`);let r=await l.card.wallet.unlink({wallet:i,chain:"solana",currency:e.currency});process.stderr.write(`Signing Revoke transaction...
57`);let{transaction:n}=await g.handler({wallet:t.name,chain:"solana",transaction:r.transaction});process.stderr.write(`Broadcasting Revoke transaction...
Long lines were clipped for display.