registry / paysafe-x402 / 1.1.1

paysafe-x402@1.1.1

PaySafe — a payment security firewall for x402 micropayment traffic. Advisory scanning: PII/secret leaks, replay, overpayment, prompt-injection-triggered payments, counterparty reputation. Non-custodial. Includes an MCP server: npx paysafe-x402

AI Security Review

scanned 18h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI/MCP server performs user-invoked payment-screening API calls; optional CDP verification is package-aligned.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit execution of the CLI/MCP tools or running the service entrypoint.

Impact

Processes caller-supplied payment data and optionally sends it to the configured PaySafe service; no unconsented credential harvesting or control-surface mutation was found.

Mechanism

Payment metadata scanning, local persistence, and configured PaySafe/CDP HTTP requests.

Rationale

Static hints are noisy: the reported invisible Unicode is intentionally embedded in detection regexes, not deceptive executable logic. Source inspection found no install-time execution, exfiltration chain, remote payload execution, persistence, or AI-agent control-surface modification.

Evidence

package.jsondist/mcp/server.jsdist/src/detectors/injection.jsdist/src/detectors/pinning.jsdist/src/index.jsdist/src/scanner.jsdist/src/config.jsdist/src/store.jsdist/src/auditlog.jsdist/src/verdictsign.js

Network endpoints3

paysafe-agent.comapi.cdp.coinbase.com/platform/v2/x402/discovery/merchant?payTo=<encoded>x402.org/facilitator

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks.
dist/src/detectors/injection.js uses invisible characters only in regexes that detect hidden text.
dist/mcp/server.js sends requests only when its MCP tools are invoked.
dist/mcp/server.js forwards PAYSAFE_API_KEY only to the configured PaySafe base URL.
dist/src/detectors/pinning.js optionally queries CDP merchant discovery for payment pin verification.
No child-process, eval/vm, dynamic loading, or agent-config writes found in dist.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 133 KB of source, external domains: api.cdp.coinbase.com, api.example.com, paysafe-agent.com, x402.org

Source & flagged code

2 flagged

dist/src/detectors/injection.jsView file

Lines 1-29javascript

1const INJECTION_TELLS = [

2 { id: "override", re: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+)?(?:previous|prior|earlier|above|your)\s+(?:instructions?|prompts?|rules?|guidance)\b/i, label: "instruction-override phrasing" },

3 { id: "new_instructions", re: /\b(?:new|updated|real|actual|true)\s+instructions?\s*[:>-]/i, label: "injected replacement instructions" },

4 { id: "pay_command", re: /\b(?:you\s+(?:must|should|need\s+to|are\s+required\s+to)|be\s+sure\s+to|immediately)\s+(?:pay|send|transfer|authorize)\b/i, label: "imperative payment command" },

5 { id: "send_to_address", re: /\b(?:send|pay|transfer)\b[^.\n]{0,80}\b(?:to|at)\s+(?:0x[0-9a-fA-F]{6,}|[1-9A-HJ-NP-Za-km-z]{32,44})/, label: "payment redirection to embedded address" },

6 { id: "secrecy", re: /\b(?:do\s+not|don'?t|never)\s+(?:tell|inform|notify|alert|mention\s+(?:this\s+)?to)\s+(?:the\s+)?(?:user|human|owner|operator)\b/i, label:

7 { id: "role_marker", re: /(?:<\/?(?:system|assistant|instructions?)>|\[(?:system|SYSTEM)\]|^system\s*:)/m, label: "spoofed role/system marker" },

8 { id: "urgency", re: /\b(?:urgent(?:ly)?|final\s+(?:warning|notice)|account\s+(?:will\s+be\s+)?(?:suspended|terminated)|within\s+\d+\s+(?:minutes?|hours?)\s+or)\b/i, label: "urgency/threat pressure" },

9 { id: "invisible_chars", re: /[‌‍⁠]/, label: "invisible/zero-width characters (hidden text)" },

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/detectors/injection.jsView on unpkg · L9

10];

11/** Scan a string for injection indicators. Exported for the deep tier and tests. */

12export function findTells(text) {

13 return INJECTION_TELLS.filter((t) => t.re.test(text)).map(({ id, label }) => ({ id, label }));

14}

15export function checkInjection(payment, context) {

16 const results = [];

17 const origin = context?.origin ?? "unknown";

18 const content = context?.content ?? "";

19 const fromUntrusted = origin === "tool_result" || origin === "fetched_content";

20 // 1. Provenance: did the decision to pay come from content the agent just read?

21 if (fromUntrusted) {

22 results.push({

23 id: "injection.untrusted_origin",

24 name: "Prompt-injection-triggered payment",

25 verdict: "flag",

26 severity: "medium",

27 reason: `This payment originated from ${origin === "tool_result" ? "a tool result" : "fetched external content"} rather than the agent's own planning step. Payments prompted by just-read content are the primary prompt-injection exfiltration path — confirm against the agent's plan before settling.`,

28 details: { origin, content_source_url: context?.content_source_url },

29 });

•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/src/api.js -> dist/src/scanner.js -> dist/src/detectors/injection.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/detectors/injection.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/src/detectors/injection.jsView file

9contains invisible/control Unicode U+200B (zero width space) { id: "invisible_chars", re: /[<U+200B><U+200C><U+200D><U+2060><U+FEFF>]/, label: "invisible/zero-width characters (hidden text)" },

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/detectors/injection.jsView on unpkg · L9

•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/src/api.js -> dist/src/scanner.js -> dist/src/detectors/injection.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/detectors/injection.jsView on unpkg

Findings

2 Critical3 Medium5 Low

CriticalTrojan Source Unicodedist/src/detectors/injection.js

CriticalTrigger Reachable Dangerous Capabilitydist/src/detectors/injection.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/src/detectors/injection.jsView file

Lines 1-29javascript

1const INJECTION_TELLS = [

3 { id: "new_instructions", re: /\b(?:new|updated|real|actual|true)\s+instructions?\s*[:>-]/i, label: "injected replacement instructions" },

4 { id: "pay_command", re: /\b(?:you\s+(?:must|should|need\s+to|are\s+required\s+to)|be\s+sure\s+to|immediately)\s+(?:pay|send|transfer|authorize)\b/i, label: "imperative payment command" },

5 { id: "send_to_address", re: /\b(?:send|pay|transfer)\b[^.\n]{0,80}\b(?:to|at)\s+(?:0x[0-9a-fA-F]{6,}|[1-9A-HJ-NP-Za-km-z]{32,44})/, label: "payment redirection to embedded address" },

6 { id: "secrecy", re: /\b(?:do\s+not|don'?t|never)\s+(?:tell|inform|notify|alert|mention\s+(?:this\s+)?to)\s+(?:the\s+)?(?:user|human|owner|operator)\b/i, label:

7 { id: "role_marker", re: /(?:<\/?(?:system|assistant|instructions?)>|\[(?:system|SYSTEM)\]|^system\s*:)/m, label: "spoofed role/system marker" },

9 { id: "invisible_chars", re: /[‌‍⁠]/, label: "invisible/zero-width characters (hidden text)" },

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src/detectors/injection.jsView on unpkg · L9

10];

11/** Scan a string for injection indicators. Exported for the deep tier and tests. */

12export function findTells(text) {

13 return INJECTION_TELLS.filter((t) => t.re.test(text)).map(({ id, label }) => ({ id, label }));

14}

15export function checkInjection(payment, context) {

16 const results = [];

17 const origin = context?.origin ?? "unknown";

18 const content = context?.content ?? "";

19 const fromUntrusted = origin === "tool_result" || origin === "fetched_content";

20 // 1. Provenance: did the decision to pay come from content the agent just read?

21 if (fromUntrusted) {

22 results.push({

23 id: "injection.untrusted_origin",

24 name: "Prompt-injection-triggered payment",

25 verdict: "flag",

26 severity: "medium",

28 details: { origin, content_source_url: context?.content_source_url },

29 });

•Trigger-reachable chain: manifest.main -> dist/src/index.js -> dist/src/api.js -> dist/src/scanner.js -> dist/src/detectors/injection.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/detectors/injection.jsView on unpkg