registry / paysafe-x402 / 1.1.0

paysafe-x402@1.1.0

PaySafe — a payment security firewall for x402 micropayment traffic. Advisory scanning: PII/secret leaks, replay, overpayment, prompt-injection-triggered payments, counterparty reputation. Non-custodial. Includes an MCP server: npx paysafe-x402

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network use is package-aligned payment-scanning/MCP API communication, and local writes support the package's own service state.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit MCP tool invocation or starting the documented HTTP service.

Impact

No evidence of unconsented execution, exfiltration, destructive behavior, or AI-agent control-surface modification.

Mechanism

Payment-security scanning, optional API calls, and local state persistence.

Rationale

The scanner's Trojan Source hit is a false positive: the only invisible characters are intentionally matched by an injection-detection regex, while the full packaged source contains no such controls. Source inspection found no install-time execution or concrete malicious behavior; network and persistence features match the stated payment-firewall service.

Evidence

package.jsondist/mcp/server.jsdist/src/detectors/injection.jsdist/src/detectors/pinning.jsdist/src/store.jsdist/src/verdictsign.jsdist/src/index.jsdist/src/scanner.jsdist/src/sanitize.jsdist/src/auditlog.js

Network endpoints3

paysafe-agent.comapi.cdp.coinbase.com/platform/v2/x402/discovery/merchantx402.org/facilitator

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no preinstall/install/postinstall hooks.
`dist/src/detectors/injection.js` embeds zero-width characters only in a detector regex; full-source scan found no bidi/zero-width controls.
`dist/mcp/server.js` exposes explicit MCP tools and sends requests only to configured PaySafe service endpoints.
No child-process, shell, eval/vm, dynamic module loading, credential harvesting, or agent-config mutation found.
Filesystem writes in `store.js`, `auditlog.js`, and `verdictsign.js` are local service state, audit records, and a mode-0600 signing key.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 133 KB of source, external domains: api.cdp.coinbase.com, api.example.com, paysafe-agent.com, x402.org

Source & flagged code

2 flagged

dist/src/detectors/injection.jsView file

Lines 1-29javascript

1const INJECTION_TELLS = [

2 { id: "override", re: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+)?(?:previous|prior|earlier|above|your)\s+(?:instructions?|prompts?|rules?|guidance)\b/i, label: "instruction-override phrasing" },

3 { id: "new_instructions", re: /\b(?:new|updated|real|actual|true)\s+instructions?\s*[:>-]/i, label: "injected replacement instructions" },

4 { id: "pay_command", re: /\b(?:you\s+(?:must|should|need\s+to|are\s+required\s+to)|be\s+sure\s+to|immediately)\s+(?:pay|send|transfer|authorize)\b/i, label: "imperative payment command" },

5 { id: "send_to_address", re: /\b(?:send|pay|transfer)\b[^.\n]{0,80}\b(?:to|at)\s+(?:0x[0-9a-fA-F]{6,}|[1-9A-HJ-NP-Za-km-z]{32,44})/, label: "payment redirection to embedded address" },

6 { id: "secrecy", re: /\b(?:do\s+not|don'?t|never)\s+(?:tell|inform|notify|alert|mention\s+(?:this\s+)?to)\s+(?:the\s+)?(?:user|human|owner|operator)\b/i, label:

7 { id: "role_marker", re: /(?:<\/?(?:system|assistant|instructions?)>|\[(?:system|SYSTEM)\]|^system\s*:)/m, label: "spoofed role/system marker" },

8 { id: "urgency", re: /\b(?:urgent(?:ly)?|final\s+(?:warning|notice)|account\s+(?:will\s+be\s+)?(?:suspended|terminated)|within\s+\d+\s+(?:minutes?|hours?)\s+or)\b/i, label: "urgency/threat pressure" },

9 { id: "invisible_chars", re: /[‌‍⁠]/, label: "invisible/zero-width characters (hidden text)" },

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/detectors/injection.jsView on unpkg · L9

10];

11/** Scan a string for injection indicators. Exported for the deep tier and tests. */

12export function findTells(text) {

13 return INJECTION_TELLS.filter((t) => t.re.test(text)).map(({ id, label }) => ({ id, label }));

14}

15export function checkInjection(payment, context) {

16 const results = [];

17 const origin = context?.origin ?? "unknown";

18 const content = context?.content ?? "";

19 const fromUntrusted = origin === "tool_result" || origin === "fetched_content";

20 // 1. Provenance: did the decision to pay come from content the agent just read?

21 if (fromUntrusted) {

22 results.push({

23 id: "injection.untrusted_origin",

24 name: "Prompt-injection-triggered payment",

25 verdict: "flag",

26 severity: "medium",

27 reason: `This payment originated from ${origin === "tool_result" ? "a tool result" : "fetched external content"} rather than the agent's own planning step. Payments prompted by just-read content are the primary prompt-injection exfiltration path — confirm against the agent's plan before settling.`,

28 details: { origin, content_source_url: context?.content_source_url },

29 });

•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/src/api.js -> dist/src/scanner.js -> dist/src/detectors/injection.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/detectors/injection.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/src/detectors/injection.jsView file

9contains invisible/control Unicode U+200B (zero width space) { id: "invisible_chars", re: /[<U+200B><U+200C><U+200D><U+2060><U+FEFF>]/, label: "invisible/zero-width characters (hidden text)" },

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/detectors/injection.jsView on unpkg · L9

•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/src/api.js -> dist/src/scanner.js -> dist/src/detectors/injection.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/detectors/injection.jsView on unpkg

Findings

2 Critical3 Medium5 Low

CriticalTrojan Source Unicodedist/src/detectors/injection.js

CriticalTrigger Reachable Dangerous Capabilitydist/src/detectors/injection.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/src/detectors/injection.jsView file

Lines 1-29javascript

1const INJECTION_TELLS = [

3 { id: "new_instructions", re: /\b(?:new|updated|real|actual|true)\s+instructions?\s*[:>-]/i, label: "injected replacement instructions" },

4 { id: "pay_command", re: /\b(?:you\s+(?:must|should|need\s+to|are\s+required\s+to)|be\s+sure\s+to|immediately)\s+(?:pay|send|transfer|authorize)\b/i, label: "imperative payment command" },

5 { id: "send_to_address", re: /\b(?:send|pay|transfer)\b[^.\n]{0,80}\b(?:to|at)\s+(?:0x[0-9a-fA-F]{6,}|[1-9A-HJ-NP-Za-km-z]{32,44})/, label: "payment redirection to embedded address" },

6 { id: "secrecy", re: /\b(?:do\s+not|don'?t|never)\s+(?:tell|inform|notify|alert|mention\s+(?:this\s+)?to)\s+(?:the\s+)?(?:user|human|owner|operator)\b/i, label:

7 { id: "role_marker", re: /(?:<\/?(?:system|assistant|instructions?)>|\[(?:system|SYSTEM)\]|^system\s*:)/m, label: "spoofed role/system marker" },

9 { id: "invisible_chars", re: /[‌‍⁠]/, label: "invisible/zero-width characters (hidden text)" },

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/detectors/injection.jsView on unpkg · L9

10];

11/** Scan a string for injection indicators. Exported for the deep tier and tests. */

12export function findTells(text) {

13 return INJECTION_TELLS.filter((t) => t.re.test(text)).map(({ id, label }) => ({ id, label }));

14}

15export function checkInjection(payment, context) {

16 const results = [];

17 const origin = context?.origin ?? "unknown";

18 const content = context?.content ?? "";

19 const fromUntrusted = origin === "tool_result" || origin === "fetched_content";

20 // 1. Provenance: did the decision to pay come from content the agent just read?

21 if (fromUntrusted) {

22 results.push({

23 id: "injection.untrusted_origin",

24 name: "Prompt-injection-triggered payment",

25 verdict: "flag",

26 severity: "medium",

28 details: { origin, content_source_url: context?.content_source_url },

29 });

•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/src/api.js -> dist/src/scanner.js -> dist/src/detectors/injection.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/detectors/injection.jsView on unpkg