twzrd-x402-gate@0.6.0
Security fixes: payment-verdict integrity issues fixed through 0.11.4 (see the 0.11.2, 0.11.3 and 0.11.4 changelogs). Upgrade to twzrd-x402-gate@0.11.4.
Buyer-side x402 trust gate. Run a free TWZRD preflight (ReadinessCard) before signing USDC to any x402 merchant, and autonomously escalate a `warn` to a $0.001 paid trust check that re-decides — blocking the spend on bad paid intel, no human in the loop.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package is a payment-gating library whose network and child-process behavior occurs only in documented runtime paths. Static inspection found no lifecycle execution, persistence, credential harvesting, remote payload execution, or AI-agent control-surface mutation.
Decision evidence
public snapshot- `dist/safe-fetch.js` spawns `npx agentcash@latest`, but only through the user-invoked CLI path.
- `dist/policy.js` posts payment-context metadata to the configurable TWZRD preflight service.
- `package.json` has only `prepublishOnly`; no install-time hook.
- No package code writes files, alters agent settings, or establishes persistence.
- `dist/config.js` env reads configure gate behavior and optional attribution only.
- `dist/merchant-card.js` and `dist/policy.js` use the configured endpoint for documented trust checks.
- `bin/twzrd-safe-fetch.js` dynamically imports its own `dist/safe-fetch.js` only.
- No eval, VM, native loader, credential harvesting, or exfiltration path found.
Source & flagged code
1 flaggedPackage source references dynamic require/import behavior.
bin/twzrd-safe-fetch.jsView on unpkg · L16Findings
Affected versions and remediation
This report applies to twzrd-x402-gate@0.6.0.
See all versions of twzrd-x402-gate for other recorded verdicts.
- Review the evidence and your use of twzrd-x402-gate@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.