registry / eddieseddies / 1.0.6
eddieseddies@1.0.6
ex420 — x402 for Eddies. Accept payments with a single line of code; HTTP 402 settled in €$ on the Eddies ledger.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe credential-like values are used with the Eddies gateway or the configured x0x daemon, and the automatic update and version-reporting pass is documented with an opt-out. The inspected source does not show credential exfiltration or another malicious action.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Network requests occur when users call MCP tools; joined family members also get a disclosed background update pass after startup and hourly.
Impact
No malicious impact identified. The README documents the background pass and its EDDIES_AUTO_UPDATE=0 opt-out.
Mechanism
Requests go to the configured x0x daemon or the Eddies gateway. The background pass uses the daemons’ and clients’ own update mechanisms and reports software versions to the family.
AI rationale
The credential-like values are used with the Eddies gateway or the configured x0x daemon, and the automatic update and version-reporting pass is documented with an opt-out. The inspected source does not show credential exfiltration or another malicious action.
Evidence
${EDDIES_IDENTITY_FILE or ~/.config/eddies/<name>.json}~/.local/share/x0x/api.port~/.local/share/x0x/api-token
Network endpoints3
dweb.eddiesexchange.comapi.eddiesexchange.com${X0XD_API_ADDR or ~/.local/share/x0x/api.port}
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package main and default export are client.js; mcp.js is a separate CLI entry point.
- The x0x token is read from the x0x configuration or an environment override and sent to the configured daemon address.
- The built-in gateway hosts belong to eddiesexchange.com, matching the package’s stated payment service.
- For joined family members, startup updates and version reporting are disclosed in the README and can be disabled with EDDIES_AUTO_UPDATE=0.
Evidence against
- mcp.js reads a local daemon token and uses it in HTTP requests.
- The MCP server starts a background update and version-reporting pass for joined family members.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flaggedmcp.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = eddieseddies@1.0.4
matchedIdentity = npm:ZWRkaWVzZWRkaWVz:1.0.4
similarity = 0.900
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
mcp.jsView on unpkg25// The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY, looksLikeAnAi } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller this AI pays,
High
Credential Exfiltration
Source combines credential-like environment material and outbound requests; review data flow before blocking.
mcp.jsView on unpkg · L2525// The wire is MCP's stdio transport: newline-delimited JSON-RPC 2.0 on
L26: // stdin/stdout. Nothing but protocol goes to stdout; notes go to stderr.
L27:
...
L30: import { join } from 'node:path';
L31: import { execFile } from 'node:child_process';
L32: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
L33: import { EddiesIdentity, DEFAULT_GATEWAY, looksLikeAnAi } from './identity.js';
...
L39:
L40: const username = (process.env.EDDIES_USERNAME || '').trim().toLowerCase();
L41: const gateway = (process.env.EDDIES_GATEWAY || DEFAULT_GATEWAY).replace(/\/+$/, '');
...
L45: const UNJOINED = 'eddie';
L46: // One allowance in the private pool per ex420-chain seller this AI pays,
Findings
2 Critical3 High4 Medium4 Low
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltamcp.js
HighCredential Exfiltrationmcp.js
HighSandbox Evasion Gated Capabilitymcp.js
HighTrigger Reachable Credential Exfiltrationmcp.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulewasm/eddies_ledger_bg.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to eddieseddies@1.0.6.
See all versions of eddieseddies for other recorded verdicts.
- Review the evidence and your use of eddieseddies@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.