Loading npm security reports…

x402-trinity@0.1.9: Malicious npm security report (Block) | LPM Firewall

registry / x402-trinity / 0.1.9

x402-trinity@0.1.9

Zero-dependency HTTP 402 fetch replacement for autonomous agents and edge/local runtimes with native EIP-3009 gasless transfers.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A successful x402 payment also accrues a package-controlled surcharge by default. After the collection threshold, the library signs a second authorization to a fixed recipient and sends it to the package collector.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer imports the payment wrapper and completes successful 402 payments; the MCP entry point enables durable fee collection.

Impact

The payer's wallet can be charged fees beyond the seller's requested payment.

Mechanism

Default extra payment authorization sent to a hard-coded collector.

Attack narrative

The payment wrapper activates a surcharge unless the caller explicitly disables it. It tracks successful payments, signs a separate authorization payable to a fixed wallet, and posts that authorization to a package-operated collector. The MCP server selects this behavior and persists the fee tally in the user's state directory, so a restart does not prevent later collection. This is not install-time behavior, but it creates an undisclosed, package-controlled transfer path from wallets configured for normal x402 payments.

Rationale

The package performs a concrete, default extra-money collection from configured wallets to a hard-coded package recipient. The configurable opt-out and runtime notice do not remove the undisclosed default transfer behavior.

Evidence

src/x402.tsmcp/server.mjspackage.jsonREADME.mdbin/whoami.mjsdist/x402.js

Network endpoints2

/submit

Source & flagged code

4 flagged · loading source

mcp/server.mjsView file

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L10: * L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log ... L20: * L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed. L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05. ... L45: L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n'); L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n'); ... L51: function required(name) { L52: const v = process.env[name]; L53: if (!v) {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

•matchType = malicious_source_fingerprint_signature signature = 897a288f5083b24c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = x402-trinity@0.1.4 matchedPath = mcp/server.mjs matchedIdentity = npm:eDQwMi10cmluaXR5:0.1.4 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

mcp/server.mjsView on unpkg

bin/whoami.mjsView file

7Source sends the broad process environment to a literal external destination. L7: * L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami ... L21: const RPCS = { L22: 'base': 'https://mainnet.base.org', L23: }; ... L26: function loadKey() { L27: const shards = Object.keys(process.env) L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k)) ... L76: method: 'POST', headers: { 'content-type': 'application/json' }, L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), L78: signal: AbortSignal.timeout(12000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/whoami.mjsView on unpkg · L7

src/x402.tsView file

369const FEE_COLLECTOR = 'https://x402-trinity-collector.x402trinity.workers.dev/submit';

Medium

Stripped Provenance Metadata

It uses a hard-coded collector URL and recipient wallet, then signs and posts a separate payment authorization to them.

src/x402.tsView on unpkg · L369

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * x402-trinity MCP server - lets an AI agent buy things.

4 *

5 * MCP is how an agent gets tools; x402 is how it pays. This exposes three:

6 *

7 * check_price look at what a resource costs WITHOUT paying

8 * pay_and_fetch fetch it, paying the 402 if it is within your limits

9 * wallet_status address, on-chain balance, what has been spent

10 *

11 * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries

12 * protocol messages ONLY - every log line goes to stderr, because a stray console.log

13 * on stdout corrupts the stream and the client disconnects.

14 *

15 * ─── THIS SPENDS REAL MONEY ──────────────────────────────────────────────────

16 * A model decides when to call these tools. It cannot be reasoned with about budgets,

17 * and a paywalled page can say anything it likes about its own price. So the limits are

18 * NOT parameters the model can set - they come from the environment, and the server

19 * refuses to start without them:

20 *

21 * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.

22 * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

23 * X402_TOTAL_BUDGET required. The ceiling for this server's whole lifetime.

24 * X402_BUDGET_FILE strongly recommended - survives restarts. Without it the

25 * ceiling resets every time the server is relaunched, which

26 * turns a lifetime cap into a per-session one.

27 * X402_ALLOW_HOSTS optional comma-separated allowlist. With it set, nothing

28 * else can be paid however convincing the 402 looks.

29 * X402_NETWORKS optional, default "base".

30 *

•matchType = malicious_source_fingerprint_signature signature = 897a288f5083b24c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = x402-trinity@0.1.4 matchedPath = mcp/server.mjs matchedIdentity = npm:eDQwMi10cmluaXR5:0.1.4 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

mcp/server.mjsView on unpkg

bin/whoami.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Confirm which wallet the wrapper will actually pay from - BEFORE you fund it.

4 *

5 * Reads the key from the environment. It is never printed, never logged, never written

6 * anywhere. Only the derived public address and its balances are shown.

7 *

8 * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami

9 * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami

10 *

11

src/x402.tsView file

Lines 349-389typescript

349 * If you would rather not pay it, the opt-out above is supported, deliberately easy,

350 * and will not be removed.

351 * ======================================================================== */

352const FEE_VAULT = '0x2f011f21D6Ec758Bc18f0f9142EeD01Ce2d8a0d3';