twzrd-x402-gate@0.9.3
Security fixes: payment-verdict integrity issues fixed through 0.11.4 (see the 0.11.2, 0.11.3 and 0.11.4 changelogs). Upgrade to twzrd-x402-gate@0.11.4.
Core: buyer-side x402 trust gate. Free TWZRD preflight (ReadinessCard) before signing USDC to any merchant, with optional $0.001 paid trust escalate on warn — blocking spend on bad intel, no human in the loop. Optional: createTwzrdSettleGuard for resource
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious lifecycle, exfiltration routine, or stealth persistence was found. The explicit CLI nevertheless executes an unpinned third-party package with inherited environment, which warrants a warning.
Decision evidence
public snapshot- The published command path can invoke a mutable external package through npx and passes the entire inherited environment to it.
- The package exposes this command as a bin executable, making the risky path directly user-invocable.
- package.json has only a prepublishOnly hook, not an install-time lifecycle hook.
- The npx invocation is in an explicit safe-fetch CLI flow; no hidden import-time execution or foreign configuration mutation was found.
- The source labels the two-request payment path as advisory and exposes the challenge mismatch rather than concealing it.
Source & flagged code
5 flaggedPackage source references child process execution.
bin/twzrd-safe-fetch.jsView on unpkg · L5This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/twzrd-gate-eval-refuse.jsView on unpkgFindings
Affected versions and remediation
This report applies to twzrd-x402-gate@0.9.3.
See all versions of twzrd-x402-gate for other recorded verdicts.
- Review the evidence and your use of twzrd-x402-gate@0.9.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.