registry / twzrd-x402-gate / 0.11.4
twzrd-x402-gate@0.11.4
Released identity 0.11.2. Buyer-side x402 trust gate: free preflight before signing USDC to a merchant. On Solana mainnet and Base mainnet (eip155:8453), a missing payTo is not approved, a buyer preflight outage does not sign unless TWZRD_FAIL_OPEN=true,
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has no install hook, and the flagged network and process actions are part of explicitly invoked payment-gating commands. The code documents a challenge-binding limitation in safe-fetch, but the inspected source does not show malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The library exports are available on import; network and payment-related CLI behavior is triggered by an explicit command or caller request.
Impact
No unrequested credential collection, unrelated data transmission, install-time action, or automatic payment behavior was found.
Mechanism
The safe-fetch CLI probes the caller-supplied URL, requests preflight from the TWZRD service, and may invoke AgentCash if allowed. The refusal-evaluation command uses a fixed TWZRD fixture.
AI rationale
The package has no install hook, and the flagged network and process actions are part of explicitly invoked payment-gating commands. The code documents a challenge-binding limitation in safe-fetch, but the inspected source does not show malicious behavior.
Network endpoints3
intel.twzrd.xyzintel.twzrd.xyz/v1/intel/refuse-fixtureintel.twzrd.xyz/v1/intel/preflight
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall hook; `prepublishOnly` runs release verification.
- The safe-fetch entry runs its main function only when invoked as a CLI, and its documented flow probes a URL, performs TWZRD preflight, then invokes AgentCash only if allowed.
- The refusal-evaluation CLI targets a fixed TWZRD fixture and checks a refusal without spending USDC.
- Preflight defaults to the package’s own `https://intel.twzrd.xyz` service.
Evidence against
- The safe-fetch CLI launches `npx agentcash@latest` with the caller’s environment when its payment path is reached.
- The safe-fetch documentation identifies a challenge mismatch risk between its preflight probe and AgentCash’s later request.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/twzrd-safe-fetch.jsView file
5*/
L6: import { spawnSync } from "node:child_process";
L7: import { existsSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/twzrd-safe-fetch.jsView on unpkg · L5bin/twzrd-gate-eval-refuse.jsView file
28const pkgRoot = join(__dirname, "..");
L29: const require = createRequire(import.meta.url);
L30:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/twzrd-gate-eval-refuse.jsView on unpkg · L28bin/twzrd-gate-doctor.jsView file
33// tsx resolves `src` by absolute path, so the user's cwd is safe to keep.
L34: const r = spawnSync("npx", ["--yes", "tsx", src, ...process.argv.slice(2)], {
L35: stdio: "inherit",
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/safe-fetch.js
HighChild Processbin/twzrd-safe-fetch.js
HighRuntime Package Installbin/twzrd-gate-doctor.js
HighSemantic Analysis Limiteddist/evidence-verify.js#virtual:normalized:round1
MediumDynamic Requirebin/twzrd-gate-eval-refuse.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to twzrd-x402-gate@0.11.4.
See all versions of twzrd-x402-gate for other recorded verdicts.
- Review the evidence and your use of twzrd-x402-gate@0.11.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.