x402-trinity@0.1.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

x402-trinity@0.1.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

4 flagged · loading source

mcp/server.mjsView file

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L10: * L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log ... L20: * L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed. L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05. ... L42: L43: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n'); L44: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n'); ... L48: function required(name) { L49: const v = process.env[name]; L50: if (!v) {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

bin/whoami.mjsView file

7Source sends the broad process environment to a literal external destination. L7: * L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami ... L21: const RPCS = { L22: 'base': 'https://mainnet.base.org', L23: }; ... L26: function loadKey() { L27: const shards = Object.keys(process.env) L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k)) ... L76: method: 'POST', headers: { 'content-type': 'application/json' }, L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), L78: signal: AbortSignal.timeout(12000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/whoami.mjsView on unpkg · L7

src/x402.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/x402.ts#virtual:normalized:round1View on unpkg

dist/x402.jsView file

827if (feeOn && paid.status < 400) { const fp = accrueFee(value, req); feeInFlight = feeInFlight.then(() => fp, () => fp); if (ctx && typeof ctx.waitUntil === "function") ctx.waitUntil(fp);

High

Ai Review Evidence

The MCP executable explicitly enables the surcharge while presenting only the seller-payment budget to its operator.

dist/x402.jsView on unpkg · L827

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * x402-trinity MCP server - lets an AI agent buy things.

4 *

5 * MCP is how an agent gets tools; x402 is how it pays. This exposes three:

6 *

7 * check_price look at what a resource costs WITHOUT paying

8 * pay_and_fetch fetch it, paying the 402 if it is within your limits

9 * wallet_status address, on-chain balance, what has been spent

10 *

11 * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries

12 * protocol messages ONLY - every log line goes to stderr, because a stray console.log

13 * on stdout corrupts the stream and the client disconnects.

14 *

15 * ─── THIS SPENDS REAL MONEY ──────────────────────────────────────────────────

16 * A model decides when to call these tools. It cannot be reasoned with about budgets,

17 * and a paywalled page can say anything it likes about its own price. So the limits are

18 * NOT parameters the model can set - they come from the environment, and the server

19 * refuses to start without them:

20 *

21 * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.

22 * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

23 * X402_TOTAL_BUDGET required. The ceiling for this server's whole lifetime.

24 * X402_BUDGET_FILE strongly recommended - survives restarts. Without it the

25 * ceiling resets every time the server is relaunched, which

26 * turns a lifetime cap into a per-session one.

27 * X402_ALLOW_HOSTS optional comma-separated allowlist. With it set, nothing

28 * else can be paid however convincing the 402 looks.

29 * X402_NETWORKS optional, default "base".

30 *

bin/whoami.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Confirm which wallet the wrapper will actually pay from - BEFORE you fund it.

4 *

5 * Reads the key from the environment. It is never printed, never logged, never written

6 * anywhere. Only the derived public address and its balances are shown.

7 *

8 * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami

9 * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami

10 *

11

src/x402.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/x402.ts#virtual:normalized:round1View on unpkg

dist/x402.jsView file

Lines 807-847javascript

807 }

808 }

809 } else unresolved++;

810 let settlement;

811 try {

812 const sr = paid.headers.get(