twzrd-x402-gate@0.5.0
Security fixes: payment-verdict integrity issues fixed through 0.11.4 (see the 0.11.2, 0.11.3 and 0.11.4 changelogs). Upgrade to twzrd-x402-gate@0.11.4.
Buyer-side x402 trust gate. Run a free TWZRD preflight (ReadinessCard) before signing USDC to any x402 merchant, and autonomously escalate a `warn` to a $0.001 paid trust check that re-decides — blocking the spend on bad paid intel, no human in the loop.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection shows a domain-specific x402 trust gate with documented, user-invoked network calls and configuration env reads, not stealth execution or package-install abuse. Optional paid checks require caller-provided x402 fetch/options and are aligned with the package purpose.
Decision evidence
public snapshot- Runtime network calls to TWZRD intel API are present in dist/policy.js, dist/merchant-card.js, dist/quick.js, and dist/evaluate.js.
- dist/evaluate.js can call user-supplied x402Fetch for paid quick/trust receipt checks when opts enable escalation/autoReceipt.
- package.json has no preinstall/install/postinstall hooks; only prepublishOnly build hook.
- dist/index.js only re-exports modules; no installer, file mutation, or agent config writes found.
- dist/config.js only reads TWZRD_* env vars for documented configuration and defaults intelBase to https://intel.twzrd.xyz.
- No child_process, eval, dynamic require/import, native binaries, filesystem writes, credential harvesting, or broad persistence found.
- Network behavior is package-aligned: x402 trust-gate preflight, merchant-card, quick, and receipt endpoints under the configured TWZRD base.
Source & flagged code
2 flaggedRuntime network calls to TWZRD intel API are present in dist/policy.js, dist/merchant-card.js, dist/quick.js, and dist/evaluate.js.
dist/policy.jsView on unpkgdist/evaluate.js can call user-supplied x402Fetch for paid quick/trust receipt checks when opts enable escalation/autoReceipt.
dist/evaluate.jsView on unpkgFindings
Affected versions and remediation
This report applies to twzrd-x402-gate@0.5.0.
See all versions of twzrd-x402-gate for other recorded verdicts.
- Review the evidence and your use of twzrd-x402-gate@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.