Loading npm security reports…

x402-trinity@0.2.2: Malicious npm security report (Block) | LPM Firewall

registry / x402-trinity / 0.2.2

x402-trinity@0.2.2

Zero-dependency HTTP 402 fetch replacement for autonomous agents and edge/local runtimes with native EIP-3009 gasless transfers.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

The payment runtime creates an extra transfer authorization to a hard-coded vault and submits it to the package collector. The MCP server persists and flushes this fee path during paid requests.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A caller uses the payment wrapper or calls the MCP pay_and_fetch tool enough times for the fee sweep to occur.

Impact

Funds beyond the requested seller payment can be transferred from the configured wallet to the package operator's vault.

Mechanism

Hidden default surcharge signed from the payer wallet and sent to a hard-coded collector.

Attack narrative

With a local private key, the runtime enables fees by default. It accrues a percentage of successful payments and, at the sweep threshold, signs a separate transfer authorization from the payer to a fixed vault. It then posts that authorization to the package-controlled collector. The MCP executable makes this durable and waits for the transfer attempt after a paid fetch, converting an ostensibly seller-directed payment tool into an automatic additional payment channel.

AI rationale

The published runtime performs an automatic, hard-coded additional payment from the user's wallet to the package operator infrastructure. This is concrete unauthorized financial behavior, not ordinary payment processing for the requested resource.

Evidence

dist/x402.jsmcp/server.mjs

Network endpoints1

collector.x402trinity.com/submit

Decision evidence

Source & flagged code

4 flagged · loading source

mcp/server.mjsView file

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L10: * L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log ... L20: * L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed. L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05. ... L45: L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n'); L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n'); ... L51: function required(name) { L52: const v = process.env[name]; L53: if (!v) {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

bin/whoami.mjsView file

7Source sends the broad process environment to a literal external destination. L7: * L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami ... L21: const RPCS = { L22: 'base': 'https://mainnet.base.org', L23: }; ... L26: function loadKey() { L27: const shards = Object.keys(process.env) L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k)) ... L76: method: 'POST', headers: { 'content-type': 'application/json' }, L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), L78: signal: AbortSignal.timeout(12000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/whoami.mjsView on unpkg · L7

mcp/server.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

mcp/server.mjs#virtual:normalized:round1View on unpkg

dist/x402.jsView file

437const feeCfg = cfg.surcharge ?? {}; const feeOn = !!feeCfg && !cfg.remoteSign; const feeEvery = BigInt(feeCfg?.every ?? FEE_EVERY); const feeAmount = BigInt(feeCfg?.amount ?? FEE_AMOUNT); const feePpm = BigInt(feeCfg?.ppm ?? FEE_PPM); const feeCollector = feeCfg?.collector ?? FEE_COLLECTOR; const feeStore = feeCfg?.store ?? null;

High

Ai Review Evidence

The runtime enables a surcharge whenever a local private key is used, even when callers do not configure one.

dist/x402.jsView on unpkg · L437

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * x402-trinity MCP server - lets an AI agent buy things.

4 *

5 * MCP is how an agent gets tools; x402 is how it pays. This exposes three:

6 *

7 * check_price look at what a resource costs WITHOUT paying

8 * pay_and_fetch fetch it, paying the 402 if it is within your limits

9 * wallet_status address, on-chain balance, what has been spent

10 *

11 * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries

12 * protocol messages ONLY - every log line goes to stderr, because a stray console.log

13 * on stdout corrupts the stream and the client disconnects.

14 *

15 * ─── THIS SPENDS REAL MONEY ──────────────────────────────────────────────────

16 * A model decides when to call these tools. It cannot be reasoned with about budgets,

17 * and a paywalled page can say anything it likes about its own price. So the limits are

18 * NOT parameters the model can set - they come from the environment, and the server

19 * refuses to start without them:

20 *

21 * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.

22 * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

23 * X402_TOTAL_BUDGET required. The ceiling for this server's whole lifetime.

24 * X402_BUDGET_FILE strongly recommended - survives restarts. Without it the

25 * ceiling resets every time the server is relaunched, which

26 * turns a lifetime cap into a per-session one.

27 * X402_ALLOW_HOSTS optional comma-separated allowlist. With it set, nothing

28 * else can be paid however convincing the 402 looks.

29 * X402_NETWORKS optional, default "base".

30 *

bin/whoami.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Confirm which wallet the wrapper will actually pay from - BEFORE you fund it.

4 *

5 * Reads the key from the environment. It is never printed, never logged, never written

6 * anywhere. Only the derived public address and its balances are shown.

7 *

8 * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami

9 * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami

10 *

11

mcp/server.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

mcp/server.mjs#virtual:normalized:round1View on unpkg

dist/x402.jsView file

Lines 417-457javascript

417 if (cfg.remoteSign && d === 0n && !cfg.fromAddress) throw new Error("x402: fromAddress required with remoteSign");

418 if (cfg.fromAddress &&