registry / paidwithtab / 2.4.0
paidwithtab@2.4.0
Give your agents spending power. tab prices any HTTP API in a JSON spec and gets it paid per request over HTTP 402 and x402, spending capped by signed mandates, settled in USDG on Robinhood Chain. Zero runtime dependencies.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged wallet transfer occurs in the explicitly invoked fund command and requires a source key and recipient. Client-side payment handling is part of the package’s stated purpose and applies mandate, spending, and token checks.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a CLI command or an application makes a payment-aware client request.
Impact
Funds may be transferred or spent within the user-configured payment flow and its limits.
Mechanism
CLI transfers require explicit source and recipient arguments; client payments are constrained by a mandate and recognized token checks.
AI rationale
The flagged wallet transfer occurs in the explicitly invoked fund command and requires a source key and recipient. Client-side payment handling is part of the package’s stated purpose and applies mandate, spending, and token checks.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports its client library; the CLI is a separate executable entry point.
- The fund command requires an explicit source key and recipient before sending funds.
- Automatic challenge payments check mandate expiry, allowed realm, and spending limits.
- EVM payments require a mandate owner and a token recognized by the client.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/src/cli.jsView file
3import { parseArgs } from 'node:util';
L4: import { [redacted] } from 'node:net';
L5: import { existsSync } from 'node:fs';
...
L36: tab catalog serve [--db catalog.db] [--port 1403] [--try-agent key.json --try-mandate mandate.json]
L37: [--try-max-per-call 0.05] [--allow-private-origins] [--seed origin]...
L38: tab evm address <key.json> key file -> 0x address
...
L54: export const PUBLIC_CATALOG = 'https://paidwithtab.com';
L55: const TAB_HOME = process.env.TAB_HOME || join(homedir(), '.tab');
L56: function log(msg) {
...
L136: // attest the owner's EVM account so the mandate works on the evm rail
L137: evmOwner: addressFromSeed(new Uint8Array(Buffer.from(owner.privateKey, 'base64url'))),
L138: });
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/src/cli.jsView on unpkg · L33Trigger-reachable chain: manifest.bin -> bin/tab.js -> dist/src/cli.js
L3: import { parseArgs } from 'node:util';
L4: import { [redacted] } from 'node:net';
L5: import { existsSync } from 'node:fs';
...
L36: tab catalog serve [--db catalog.db] [--port 1403] [--try-agent key.json --try-mandate mandate.json]
L37: [--try-max-per-call 0.05] [--allow-private-origins] [--seed origin]...
L38: tab evm address <key.json> key file -> 0x address
...
L54: export const PUBLIC_CATALOG = 'https://paidwithtab.com';
L55: const TAB_HOME = process.env.TAB_HOME || join(homedir(), '.tab');
L56: function log(msg) {
...
L136: // attest the owner's EVM account so the mandate works on the evm rail
L137: evmOwner: addressFromSeed(new Uint8Array(Buffer.from(owner.privateKey,
Critical
Findings
2 Critical3 Medium7 Low
CriticalWallet Draindist/src/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/src/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/src/cli.js
Affected versions and remediation
This report applies to paidwithtab@2.4.0.
See all versions of paidwithtab for other recorded verdicts.
- Review the evidence and your use of paidwithtab@2.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.