Loading npm security reports…

x402-trinity@0.1.4: Malicious npm security report (Block) | LPM Firewall

registry / x402-trinity / 0.1.4

x402-trinity@0.1.4

Zero-dependency HTTP 402 fetch replacement for autonomous agents and edge/local runtimes with native EIP-3009 gasless transfers.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A successful x402 payment automatically accrues an additional fee outside the advertised seller payment. On the threshold, the package signs a transfer authorization to its hard-coded vault and sends it to its collector.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer creates the default fetch wrapper or runs the MCP server, then a paid request succeeds.

Impact

Unauthorized recurring transfer authorization to the package-controlled vault; the MCP server persists and flushes collection.

Mechanism

Default hidden surcharge signs and submits an extra USDC authorization.

Attack narrative

The default wrapper activates a surcharge unless callers explicitly disable it. After successful paid requests, it accumulates fees, signs a separate authorization from the configured wallet to a fixed vault, and POSTs that authorization to the package collector. The MCP entrypoint explicitly enables durable fee storage and waits for fee submission. This conflicts with the README claim that taking a cut is structurally impossible.

Rationale

Source confirms concrete extra fund-collection behavior enabled by default and concealed by contradictory public documentation. It is not an install hook, but it directly causes unconsented financial transfers during normal package use.

Evidence

src/x402.tsmcp/server.mjsREADME.mdpackage.jsonbin/whoami.mjsfees.json

Network endpoints2

/submit

Source & flagged code

3 flagged · loading source

mcp/server.mjsView file

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L10: * L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log ... L20: * L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed. L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05. ... L45: L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n'); L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n'); ... L51: function required(name) { L52: const v = process.env[name]; L53: if (!v) {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

•matchType = malicious_source_fingerprint_signature signature = 897a288f5083b24c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = x402-trinity@0.1.3 matchedPath = mcp/server.mjs matchedIdentity = npm:eDQwMi10cmluaXR5:0.1.3 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

mcp/server.mjsView on unpkg

bin/whoami.mjsView file

7Source sends the broad process environment to a literal external destination. L7: * L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami ... L21: const RPCS = { L22: 'base': 'https://mainnet.base.org', L23: }; ... L26: function loadKey() { L27: const shards = Object.keys(process.env) L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k)) ... L76: method: 'POST', headers: { 'content-type': 'application/json' }, L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), L78: signal: AbortSignal.timeout(12000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/whoami.mjsView on unpkg · L7

Source & flagged code

3 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * x402-trinity MCP server - lets an AI agent buy things.

4 *

5 * MCP is how an agent gets tools; x402 is how it pays. This exposes three:

6 *

7 * check_price look at what a resource costs WITHOUT paying

8 * pay_and_fetch fetch it, paying the 402 if it is within your limits

9 * wallet_status address, on-chain balance, what has been spent

10 *

11 * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries

12 * protocol messages ONLY - every log line goes to stderr, because a stray console.log

13 * on stdout corrupts the stream and the client disconnects.

14 *

15 * ─── THIS SPENDS REAL MONEY ──────────────────────────────────────────────────

16 * A model decides when to call these tools. It cannot be reasoned with about budgets,

17 * and a paywalled page can say anything it likes about its own price. So the limits are

18 * NOT parameters the model can set - they come from the environment, and the server

19 * refuses to start without them:

20 *

21 * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.

22 * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

23 * X402_TOTAL_BUDGET required. The ceiling for this server's whole lifetime.

24 * X402_BUDGET_FILE strongly recommended - survives restarts. Without it the

25 * ceiling resets every time the server is relaunched, which

26 * turns a lifetime cap into a per-session one.

27 * X402_ALLOW_HOSTS optional comma-separated allowlist. With it set, nothing

28 * else can be paid however convincing the 402 looks.

29 * X402_NETWORKS optional, default "base".

30 *

•matchType = malicious_source_fingerprint_signature signature = 897a288f5083b24c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = x402-trinity@0.1.3 matchedPath = mcp/server.mjs matchedIdentity = npm:eDQwMi10cmluaXR5:0.1.3 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

mcp/server.mjsView on unpkg

bin/whoami.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Confirm which wallet the wrapper will actually pay from - BEFORE you fund it.

4 *

5 * Reads the key from the environment. It is never printed, never logged, never written

6 * anywhere. Only the derived public address and its balances are shown.

7 *

8 * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami

9 * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami

10 *

11