eddieseddies
ex420 — x402 for Eddies. Accept payments with a single line of code; HTTP 402 settled in €$ on the Eddies ledger.
This report shows the evidence for eddieseddies@1.0.5. 1 of 4 known versions is blocked or flagged. The newest version, 1.0.6, is allowed. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically uses a joined account to post its name and software versions to the family group on startup and hourly. The opt-out does not make this unsolicited account action requested, so the package is malicious under the account-action rule.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
MCP server startup for a joined identity; first run is scheduled after one minute, then hourly by default.
Impact
Uses the account’s credentials to publish to the family group without a user-initiated posting request.
Mechanism
The background software routine reads installed software versions and sends an x0x group message containing the account name and versions. It can be disabled with EDDIES_AUTO_UPDATE=0, but the post still occurs by default without a specific user request.
Attack narrative
When the MCP server starts with a joined identity, a background timer invokes the software routine after one minute and hourly thereafter. The routine gathers x0x, ant and ant-node versions, then posts a message containing those versions and the account name to the family group through the local x0x daemon. This is an automatic credential-backed account post without a user request for that post; the opt-out does not make it requested.
AI rationale
The package automatically uses a joined account to post its name and software versions to the family group on startup and hourly. The opt-out does not make this unsolicited account action requested, so the package is malicious under the account-action rule.
Evidence
mcp.jsgateway.js
Network endpoints3
${X0XD_API_ADDR or ~/.local/share/x0x/api.port}/groups/${group_id}/senddweb.eddiesexchange.com/api/familyapi.eddiesexchange.com/api/family
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- A joined MCP server starts a timer that runs the software routine after one minute and then hourly by default; setting EDDIES_AUTO_UPDATE=0 disables it.
- The routine collects x0x, ant and ant-node versions, then posts them with the account name to the family group through the x0x daemon.
- The package signs gateway writes with the identity key and defaults to Eddies gateway hosts.
Evidence against
- The x0x bearer token is read from its local configuration or an explicitly configured environment variable and sent to the configured x0x address.
- The automatic post contains the account name and software versions; the inspected code does not show other credentials or file contents being sent.
- The manifest has no install, preinstall or postinstall hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flaggedmcp.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = eddieseddies@1.0.4
matchedIdentity = npm:ZWRkaWVzZWRkaWVz:1.0.4
similarity = 0.900
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
mcp.jsView on unpkg25// The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY, looksLikeAnAi } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller this AI pays,
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
mcp.jsView on unpkg · L2525// The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY, looksLikeAnAi } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller this AI pays,
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
mcp.jsView on unpkg · L2525Trigger-reachable credential exfiltration chain: manifest.bin -> mcp.js
L25: // The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY, looksLikeAnAi } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
mcp.jsView on unpkg · L25wasm/eddies_ledger_bg.wasmView file
•path = wasm/eddies_ledger_bg.wasm
kind = wasm_module
sizeBytes = 2179481
magicHex = [redacted]
Medium
package.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgFindings
2 Critical3 High4 Medium4 Low
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltamcp.js
HighCredential Exfiltrationmcp.js
HighSandbox Evasion Gated Capabilitymcp.js
HighTrigger Reachable Credential Exfiltrationmcp.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulewasm/eddies_ledger_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to eddieseddies@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing eddieseddies@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.