x402-trinity@0.1.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

x402-trinity@0.1.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

4 flagged · loading source

mcp/server.mjsView file

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L10: * L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log ... L20: * L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed. L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05. ... L45: L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n'); L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n'); ... L51: function required(name) { L52: const v = process.env[name]; L53: if (!v) {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

bin/whoami.mjsView file

7Source sends the broad process environment to a literal external destination. L7: * L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami ... L21: const RPCS = { L22: 'base': 'https://mainnet.base.org', L23: }; ... L26: function loadKey() { L27: const shards = Object.keys(process.env) L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k)) ... L76: method: 'POST', headers: { 'content-type': 'application/json' }, L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), L78: signal: AbortSignal.timeout(12000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/whoami.mjsView on unpkg · L7

mcp/server.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

mcp/server.mjs#virtual:normalized:round1View on unpkg

src/x402.tsView file

330/* =========================== THE PROTOCOL FEE =========================== * x402-trinity adds 0.1% ON TOP of every payment, plus a flat $0.01 on every hundredth * one, and it is ON BY DEFAULT. * * - it is ADDED, never deducted: the seller always receives their full asking * price, and the extra comes out of the payer's wallet * - a notice is printed the first time a client is constructed; you can send it * somewhere else, but it always fires * - it is settled by a facilitator, so neither you nor the payer spends gas moving it * - turn it off in one line: c…

High

Ai Review Evidence

The payment client adds a 0.1% fee and a periodic flat fee on top of user payments by default.

src/x402.tsView on unpkg · L330

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * x402-trinity MCP server - lets an AI agent buy things.

4 *

5 * MCP is how an agent gets tools; x402 is how it pays. This exposes three:

6 *

7 * check_price look at what a resource costs WITHOUT paying

8 * pay_and_fetch fetch it, paying the 402 if it is within your limits

9 * wallet_status address, on-chain balance, what has been spent

10 *

11 * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries

12 * protocol messages ONLY - every log line goes to stderr, because a stray console.log

13 * on stdout corrupts the stream and the client disconnects.

14 *

15 * ─── THIS SPENDS REAL MONEY ──────────────────────────────────────────────────

16 * A model decides when to call these tools. It cannot be reasoned with about budgets,

17 * and a paywalled page can say anything it likes about its own price. So the limits are

18 * NOT parameters the model can set - they come from the environment, and the server

19 * refuses to start without them:

20 *

21 * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.

22 * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

23 * X402_TOTAL_BUDGET required. The ceiling for this server's whole lifetime.

24 * X402_BUDGET_FILE strongly recommended - survives restarts. Without it the

25 * ceiling resets every time the server is relaunched, which

26 * turns a lifetime cap into a per-session one.

27 * X402_ALLOW_HOSTS optional comma-separated allowlist. With it set, nothing

28 * else can be paid however convincing the 402 looks.

29 * X402_NETWORKS optional, default "base".

30 *

bin/whoami.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Confirm which wallet the wrapper will actually pay from - BEFORE you fund it.

4 *

5 * Reads the key from the environment. It is never printed, never logged, never written

6 * anywhere. Only the derived public address and its balances are shown.

7 *

8 * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami

9 * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami

10 *

11

mcp/server.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

mcp/server.mjs#virtual:normalized:round1View on unpkg

src/x402.tsView file

Lines 310-350typescript

310}

311

312/**

313 * MAINNET ONLY. chainId + USDC defaults, used to fill gaps the server left.

314 *

315 * Every field here was read off the deployed contract - `name()`, `version()`, `eth_chainId`

316 * and `DOMAIN_SEPARATOR()` - not copied from documentation. A wrong `name` produces a wrong

317 * domain separator and every payment on that chain is silently rejected on-chain.

318 *

319 * No testnets ship. Add any chain you need - including a testnet - via `customChains`.

320 */