twzrd-x402-gate@0.5.2
Security fixes: payment-verdict integrity issues fixed through 0.11.4 (see the 0.11.2, 0.11.3 and 0.11.4 changelogs). Upgrade to twzrd-x402-gate@0.11.4.
Buyer-side x402 trust gate. Run a free TWZRD preflight (ReadinessCard) before signing USDC to any x402 merchant, and autonomously escalate a `warn` to a $0.001 paid trust check that re-decides — blocking the spend on bad paid intel, no human in the loop.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection shows a payment-safety library with user-invoked network and subprocess behavior aligned to its x402 trust-gate purpose, not install-time execution or covert data theft. The suspicious primitives are opt-in runtime/CLI paths with package-specific endpoints and no unconsented agent control-surface mutation.
Decision evidence
public snapshot- bin/twzrd-safe-fetch.js uses child_process spawnSync only as a dev fallback when dist is absent
- dist/safe-fetch.js can spawn npx agentcash@latest fetch after explicit CLI invocation and TWZRD approval
- dist/evaluate.js optionally calls paid TWZRD quick/trust endpoints when caller supplies x402Fetch and opts in
- package.json has no install/preinstall/postinstall hooks; only prepublishOnly build hook
- dist/config.js defaults network calls to package-aligned https://intel.twzrd.xyz and env overrides are TWZRD-specific
- dist/policy.js posts payment metadata to /v1/intel/preflight for trust gating; no credential/env/file harvesting found
- dist/with-guard.js, dist/wrap-fetch.js, dist/mcp-hook.js, and dist/x402-client-hook.js gate x402 payments before signing instead of mutating agent config
- No file writes, persistence, broad AI-agent control-surface mutation, eval/vm, or native/binary loading found
Source & flagged code
2 flaggedPackage source references dynamic require/import behavior.
bin/twzrd-safe-fetch.jsView on unpkg · L16This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/safe-fetch.jsView on unpkgFindings
Affected versions and remediation
This report applies to twzrd-x402-gate@0.5.2.
See all versions of twzrd-x402-gate for other recorded verdicts.
- Review the evidence and your use of twzrd-x402-gate@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.