registry / eddieseddies / 1.0.4
eddieseddies@1.0.4
ex420 — x402 for Eddies. Accept payments with a single line of code; HTTP 402 settled in €$ on the Eddies ledger.
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe credential hint resolves to signed Eddies API requests, with the identity key used to create signatures rather than sent as raw data. The automatic updater is limited to joined instances, can be disabled, and delegates updates to the x0x and ant updaters; no concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
MCP starts its update timer for a joined identity unless EDDIES_AUTO_UPDATE is set to 0; payment operations run through payment tools and routes.
Impact
No malicious impact was established: the inspected paths do not transfer the raw identity key or perform unrelated automatic account actions.
Mechanism
The package signs Eddies gateway requests and passes payment payloads to payment endpoints. Its updater asks the configured x0x daemon to apply updates and runs ant update.
AI rationale
The credential hint resolves to signed Eddies API requests, with the identity key used to create signatures rather than sent as raw data. The automatic updater is limited to joined instances, can be disabled, and delegates updates to the x0x and ant updaters; no concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the client and MCP entrypoints and has only a test script; no install lifecycle hook is declared.
- The identity signs Eddies writes using its key, and MCP sends the signed request to the configured gateway. I found no transfer of the raw identity key.
- The flagged gateway and chain paths handle Eddies payment charges, pool transfers, allowances, and claims; they do not show unrelated automatic account actions.
- The MCP updater runs only for a joined identity, unless disabled with EDDIES_AUTO_UPDATE=0; it is also exposed as an explicit tool.
- The updater delegates to the configured x0x daemon and ant updater. The inspected code does not show a separate payload download or execution path.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
5 flaggedmcp.jsView file
25// The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller this AI pays,
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
mcp.jsView on unpkg · L2525// The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller this AI pays,
High
Sandbox Evasion Gated Capability
Findings
1 Critical3 High4 Medium4 Low
CriticalManifest Confusionpackage.json
HighCredential Exfiltrationmcp.js
HighSandbox Evasion Gated Capabilitymcp.js
HighTrigger Reachable Credential Exfiltrationmcp.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulewasm/eddies_ledger_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to eddieseddies@1.0.4.
See all versions of eddieseddies for other recorded verdicts.
- Review the evidence and your use of eddieseddies@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.