Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All MCP servers
MCP server

io.github.x402node/x402-mcp

mcp:x402node/x402-mcp

Hundreds of x402-paid APIs as MCP tools, auto-discovered from Coinbase Bazaar. USDC on Base+Solana.

awesome-mcp-serversGlamaMCP Registry
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 12:45 UTC at e5cd11c

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

2
findings
critical
highest severity
2
threat classes
13
files scanned
379/379
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding mcp-server:.:mcp-server.js:69:TOOLPOISON
  • suspicious: finding mcp-server:.:package-lock.json:2:SUPPLY

Security findings 2

Tool poisoning

criticalContextual risklow confidence

Tool names, descriptions and input schemas are built at runtime from a remote Coinbase Bazaar discovery response (refreshed periodically), so remote data can set agent-visible tool metadata and the URLs that get auto-paid with the user's private key (capped by a max price); this dynamic remote tool surface is not stated in the declared claims.

mcp-server.js:69
const desc = (accept.description || resource.resource).slice(0, 500);
conceal:remotevector:code
Counter-argument considered

Tool descriptions and input schemas come from a remote feed with no sanitization beyond a 500-character truncation, and are exposed to the agent as tool metadata. The server declares nothing, so a malicious or compromised feed entry could carry injected instructions. Severity is low because the feed is filtered by the configured payTo address, but I found no evidence that kills the finding.

Supply chain

highContextual riskmedium confidence

The lockfile resolves the 'ox' dependency from a mutable pre-release preview URL (pkg.pr.new, commit-pinned build) instead of the npm registry, which bypasses normal registry provenance.

package-lock.json:2-7500
packages.node_modules/ox.resolved: https://pkg.pr.new/ox@386a3439fe1ce76d237930f8c6e6bb493746069a
conceal:remotevector:metadata
Counter-argument considered

The lockfile does resolve ox from pkg.pr.new, a non-registry host, and npm install will fetch it. The build is commit-pinned with an integrity hash, so 'mutable' overstates it, but no carve-out or mitigation clears a non-registry source, so the finding stands as a contextual risk.

Execution chain 500

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 5

BASE_RPC_URL
mcp-server.js:13 · read
X402_MAX_PRICE_USD
mcp-server.js:14 · read
X402_PAY_TO
mcp-server.js:11 · read
X402_PRIVATE_KEY
mcp-server.js:12 · read
X402_REFRESH_MIN
mcp-server.js:15 · read

GitHub repositories 15

chalk/ansi-styles
package-lock.json:3884 · url
chalk/chalk
package-lock.json:4175 · url
walletconnect/walletconnect-monorepo
package-lock.json:1098 · url
walletconnect/walletconnect-monorepo
package-lock.json:1130 · url
walletconnect/walletconnect-monorepo
package-lock.json:1466 · url
walletconnect/walletconnect-monorepo
package-lock.json:1498 · url
walletconnect/walletconnect-monorepo
package-lock.json:1786 · url
walletconnect/walletconnect-monorepo
package-lock.json:1818 · url
walletconnect/walletconnect-monorepo
package-lock.json:3251 · url
walletconnect/walletconnect-monorepo
package-lock.json:3483 · url
walletconnect/walletconnect-monorepo
package-lock.json:3530 · url
x402node/x402-mcp
package.json:38 · url
x402node/x402-mcp
package.json:41 · url
x402node/x402-mcp
package.json:44 · url
x402node/x402-mcp
server.json:6 · url

Network calls 2

api.cdp.coinbase.com
mcp-server.js:33 · call
mainnet.base.org
mcp-server.js:13 · url_literal

Packages 1

npm:x402node-mcp@1.0.3
server.json:13 · launch:server.json

URLs 477

https://api.cdp.coinbase.com/platform/v2/x402/discovery/merchant?payTo=$
mcp-server.js:22
https://docs.metamask.io/metamask-connect
package-lock.json:711
https://docs.metamask.io/metamask-connect
package-lock.json:749
https://docs.metamask.io/metamask-connect
package-lock.json:793
https://dotenvx.com
package-lock.json:4517
https://feross.org/support
package-lock.json:3983
https://feross.org/support
package-lock.json:4061
https://feross.org/support
package-lock.json:5353
https://feross.org/support
package-lock.json:6514
https://github.com/chalk/ansi-styles?sponsor=1
package-lock.json:3884
https://github.com/chalk/chalk?sponsor=1
package-lock.json:4175
https://github.com/sponsors/brc-dd
package-lock.json:5388
https://github.com/sponsors/broofa
package-lock.json:435
https://github.com/sponsors/broofa
package-lock.json:516
https://github.com/sponsors/broofa
package-lock.json:565
https://github.com/sponsors/broofa
package-lock.json:677
https://github.com/sponsors/broofa
package-lock.json:858
https://github.com/sponsors/colinhacks
package-lock.json:156
https://github.com/sponsors/colinhacks
package-lock.json:1296
https://github.com/sponsors/colinhacks
package-lock.json:1664
https://github.com/sponsors/colinhacks
package-lock.json:1685
https://github.com/sponsors/colinhacks
package-lock.json:1984
https://github.com/sponsors/colinhacks
package-lock.json:3762
https://github.com/sponsors/colinhacks
package-lock.json:7387
https://github.com/sponsors/colinhacks
package-lock.json:7396
https://github.com/sponsors/colinhacks
package-lock.json:7463
https://github.com/sponsors/ctavan
package-lock.json:436
https://github.com/sponsors/ctavan
package-lock.json:517
https://github.com/sponsors/ctavan
package-lock.json:566
https://github.com/sponsors/ctavan
package-lock.json:678
https://github.com/sponsors/ctavan
package-lock.json:859
https://github.com/sponsors/epoberezkin
package-lock.json:3843
https://github.com/sponsors/express-rate-limit
package-lock.json:4954
https://github.com/sponsors/fastify
package-lock.json:5001
https://github.com/sponsors/feross
package-lock.json:3975
https://github.com/sponsors/feross
package-lock.json:4053
https://github.com/sponsors/feross
package-lock.json:5345
https://github.com/sponsors/feross
package-lock.json:6506
https://github.com/sponsors/jonschlinkert
package-lock.json:6092
https://github.com/sponsors/ljharb
package-lock.json:3936
https://github.com/sponsors/ljharb
package-lock.json:4107
https://github.com/sponsors/ljharb
package-lock.json:4136
https://github.com/sponsors/ljharb
package-lock.json:4454
https://github.com/sponsors/ljharb
package-lock.json:5085
https://github.com/sponsors/ljharb
package-lock.json:5149
https://github.com/sponsors/ljharb
package-lock.json:5191
https://github.com/sponsors/ljharb
package-lock.json:5216
https://github.com/sponsors/ljharb
package-lock.json:5245
https://github.com/sponsors/ljharb
package-lock.json:5257
https://github.com/sponsors/ljharb
package-lock.json:5272
https://github.com/sponsors/ljharb
package-lock.json:5404
https://github.com/sponsors/ljharb
package-lock.json:5422
https://github.com/sponsors/ljharb
package-lock.json:5450
https://github.com/sponsors/ljharb
package-lock.json:5474
https://github.com/sponsors/ljharb
package-lock.json:5513
https://github.com/sponsors/ljharb
package-lock.json:5924
https://github.com/sponsors/ljharb
package-lock.json:6353
https://github.com/sponsors/ljharb
package-lock.json:6533
https://github.com/sponsors/ljharb
package-lock.json:6654
https://github.com/sponsors/ljharb
package-lock.json:6694
https://github.com/sponsors/ljharb
package-lock.json:6710
https://github.com/sponsors/ljharb
package-lock.json:6728
https://github.com/sponsors/ljharb
package-lock.json:6747
https://github.com/sponsors/ljharb
package-lock.json:7305
https://github.com/sponsors/panva
package-lock.json:5549
https://github.com/sponsors/RubenVerborgh
package-lock.json:5060
https://github.com/sponsors/sindresorhus
package-lock.json:4763
https://github.com/sponsors/sindresorhus
package-lock.json:5486
https://github.com/sponsors/sindresorhus
package-lock.json:5498
https://github.com/sponsors/sindresorhus
package-lock.json:5726
https://github.com/sponsors/sindresorhus
package-lock.json:6022
https://github.com/sponsors/sindresorhus
package-lock.json:6371
https://github.com/sponsors/tannerlinsley
package-lock.json:3038
https://github.com/sponsors/tannerlinsley
package-lock.json:3052
https://github.com/sponsors/wagmi-dev
package-lock.json:5767
https://github.com/sponsors/wevm
package-lock.json:75
https://github.com/sponsors/wevm
package-lock.json:135
https://github.com/sponsors/wevm
package-lock.json:194
https://github.com/sponsors/wevm
package-lock.json:1179
https://github.com/sponsors/wevm
package-lock.json:1208
https://github.com/sponsors/wevm
package-lock.json:1230
https://github.com/sponsors/wevm
package-lock.json:1245
https://github.com/sponsors/wevm
package-lock.json:1547
https://github.com/sponsors/wevm
package-lock.json:1576
https://github.com/sponsors/wevm
package-lock.json:1598
https://github.com/sponsors/wevm
package-lock.json:1613
https://github.com/sponsors/wevm
package-lock.json:1867
https://github.com/sponsors/wevm
package-lock.json:1896
https://github.com/sponsors/wevm
package-lock.json:1918
https://github.com/sponsors/wevm
package-lock.json:1933
https://github.com/sponsors/wevm
package-lock.json:3102
https://github.com/sponsors/wevm
package-lock.json:3126
https://github.com/sponsors/wevm
package-lock.json:3644
https://github.com/sponsors/wevm
package-lock.json:3666
https://github.com/sponsors/wevm
package-lock.json:3681
https://github.com/sponsors/wevm
package-lock.json:3710
https://github.com/sponsors/wevm
package-lock.json:3802
https://github.com/sponsors/wevm
package-lock.json:5535
https://github.com/sponsors/wevm
package-lock.json:5987
https://github.com/sponsors/wevm
package-lock.json:6231
https://github.com/sponsors/wevm
package-lock.json:7196
https://github.com/sponsors/wevm
package-lock.json:7230
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:1098
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:1130
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:1466
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:1498
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:1786
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:1818
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:3251
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:3483
https://github.com/WalletConnect/walletconnect-monorepo/releases
package-lock.json:3530
https://github.com/x402node/x402-mcp
server.json:6
https://github.com/x402node/x402-mcp.git
package.json:41
https://github.com/x402node/x402-mcp/issues
package.json:44
https://github.com/x402node/x402-mcp#readme
package.json:38
https://mainnet.base.org
.env.example:2
https://mainnet.base.org
mcp-server.js:13
https://mainnet.base.org
smithery.yaml:15
https://mainnet.base.org
smithery.yaml:34
https://opencollective.com/bigjs
package-lock.json:3998
https://opencollective.com/date-fns
package-lock.json:4396
https://opencollective.com/express
package-lock.json:4028
https://opencollective.com/express
package-lock.json:4271
https://opencollective.com/express
package-lock.json:4327
https://opencollective.com/express
package-lock.json:4939
https://opencollective.com/express
package-lock.json:5037
https://opencollective.com/express
package-lock.json:5313
https://opencollective.com/express
package-lock.json:5329
https://opencollective.com/express
package-lock.json:5757
https://opencollective.com/express
package-lock.json:6080
https://opencollective.com/express
package-lock.json:6586
https://opencollective.com/express
package-lock.json:6605
https://opencollective.com/express
package-lock.json:6932
https://opencollective.com/express
package-lock.json:6945
https://opencollective.com/fastify
package-lock.json:5005
https://opencollective.com/preact
package-lock.json:6270
https://paulmillr.com/funding/
package-lock.json:65
https://paulmillr.com/funding/
package-lock.json:106
https://paulmillr.com/funding/
package-lock.json:184
https://paulmillr.com/funding/
package-lock.json:225
https://paulmillr.com/funding/
package-lock.json:915
https://paulmillr.com/funding/
package-lock.json:930
https://paulmillr.com/funding/
package-lock.json:942
https://paulmillr.com/funding/
package-lock.json:952
https://paulmillr.com/funding/
package-lock.json:1009
https://paulmillr.com/funding/
package-lock.json:1024
https://paulmillr.com/funding/
package-lock.json:1036
https://paulmillr.com/funding/
package-lock.json:1050
https://paulmillr.com/funding/
package-lock.json:1063
https://paulmillr.com/funding/
package-lock.json:1377
https://paulmillr.com/funding/
package-lock.json:1392
https://paulmillr.com/funding/
package-lock.json:1404
https://paulmillr.com/funding/
package-lock.json:1418
https://paulmillr.com/funding/
package-lock.json:1431
https://paulmillr.com/funding/
package-lock.json:1697
https://paulmillr.com/funding/
package-lock.json:1712
https://paulmillr.com/funding/
package-lock.json:1724
https://paulmillr.com/funding/
package-lock.json:1738
https://paulmillr.com/funding/
package-lock.json:1751
https://paulmillr.com/funding/
package-lock.json:2023
https://paulmillr.com/funding/
package-lock.json:2037
https://paulmillr.com/funding/
package-lock.json:2050
https://paulmillr.com/funding/
package-lock.json:3449
https://paulmillr.com/funding/
package-lock.json:3461
https://paulmillr.com/funding/
package-lock.json:3581
https://paulmillr.com/funding/
package-lock.json:3596
https://paulmillr.com/funding/
package-lock.json:3608
https://paulmillr.com/funding/
package-lock.json:3622
https://paulmillr.com/funding/
package-lock.json:3635
https://paulmillr.com/funding/
package-lock.json:4199
https://paulmillr.com/funding/
package-lock.json:4575
https://paulmillr.com/funding/
package-lock.json:4806
https://paulmillr.com/funding/
package-lock.json:4818
https://paulmillr.com/funding/
package-lock.json:4827
https://paulmillr.com/funding/
package-lock.json:4841
https://paulmillr.com/funding/
package-lock.json:4854
https://paulmillr.com/funding/
package-lock.json:6447
https://pkg.pr.new/ox@386a3439fe1ce76d237930f8c6e6bb493746069a
package-lock.json:5982
https://pkg.pr.new/ox@386a3439fe1ce76d237930f8c6e6bb493746069a
package-lock.json:7207
https://registry.npmjs.org/@adraffy/ens-normalize/-/ens-normalize-1.11.1.tgz
package-lock.json:26
https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz
package-lock.json:32
https://registry.npmjs.org/@base-org/account/-/account-2.4.0.tgz
package-lock.json:41
https://registry.npmjs.org/@coinbase/cdp-sdk/-/cdp-sdk-1.50.0.tgz
package-lock.json:111
https://registry.npmjs.org/@coinbase/wallet-sdk/-/wallet-sdk-3.9.3.tgz
package-lock.json:4151
https://registry.npmjs.org/@coinbase/wallet-sdk/-/wallet-sdk-4.3.6.tgz
package-lock.json:161
https://registry.npmjs.org/@ecies/ciphers/-/ciphers-0.2.6.tgz
package-lock.json:230
https://registry.npmjs.org/@ethereumjs/common/-/common-3.2.0.tgz
package-lock.json:244
https://registry.npmjs.org/@ethereumjs/rlp/-/rlp-4.0.1.tgz
package-lock.json:254
https://registry.npmjs.org/@ethereumjs/tx/-/tx-4.2.0.tgz
package-lock.json:266
https://registry.npmjs.org/@ethereumjs/util/-/util-8.1.0.tgz
package-lock.json:281
https://registry.npmjs.org/@gemini-wallet/core/-/core-0.3.2.tgz
package-lock.json:295
https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz
package-lock.json:308
https://registry.npmjs.org/@lit-labs/ssr-dom-shim/-/ssr-dom-shim-1.6.0.tgz
package-lock.json:320
https://registry.npmjs.org/@lit/reactive-element/-/reactive-element-2.1.2.tgz
package-lock.json:326
https://registry.npmjs.org/@metamask/eth-json-rpc-provider/-/eth-json-rpc-provider-1.0.1.tgz
package-lock.json:335
https://registry.npmjs.org/@metamask/json-rpc-engine/-/json-rpc-engine-7.3.3.tgz
package-lock.json:348
https://registry.npmjs.org/@metamask/json-rpc-engine/-/json-rpc-engine-8.0.2.tgz
package-lock.json:445
https://registry.npmjs.org/@metamask/json-rpc-middleware-stream/-/json-rpc-middleware-stream-7.0.2.tgz
package-lock.json:526
https://registry.npmjs.org/@metamask/object-multiplex/-/object-multiplex-2.1.0.tgz
package-lock.json:575
https://registry.npmjs.org/@metamask/onboarding/-/onboarding-1.0.1.tgz
package-lock.json:588
https://registry.npmjs.org/@metamask/providers/-/providers-16.1.0.tgz
package-lock.json:597
https://registry.npmjs.org/@metamask/rpc-errors/-/rpc-errors-6.4.0.tgz
package-lock.json:382
https://registry.npmjs.org/@metamask/rpc-errors/-/rpc-errors-6.4.0.tgz
package-lock.json:459
https://registry.npmjs.org/@metamask/rpc-errors/-/rpc-errors-6.4.0.tgz
package-lock.json:620
https://registry.npmjs.org/@metamask/rpc-errors/-/rpc-errors-7.0.2.tgz
package-lock.json:687
https://registry.npmjs.org/@metamask/safe-event-emitter/-/safe-event-emitter-2.0.0.tgz
package-lock.json:5574
https://registry.npmjs.org/@metamask/safe-event-emitter/-/safe-event-emitter-3.1.2.tgz
package-lock.json:700
https://registry.npmjs.org/@metamask/sdk-analytics/-/sdk-analytics-0.0.5.tgz
package-lock.json:737
https://registry.npmjs.org/@metamask/sdk-communication-layer/-/sdk-communication-layer-0.33.1.tgz
package-lock.json:747
https://registry.npmjs.org/@metamask/sdk-install-modal-web/-/sdk-install-modal-web-0.32.1.tgz
package-lock.json:791
https://registry.npmjs.org/@metamask/sdk/-/sdk-0.33.1.tgz
package-lock.json:709
https://registry.npmjs.org/@metamask/superstruct/-/superstruct-3.2.1.tgz
package-lock.json:823
https://registry.npmjs.org/@metamask/utils/-/utils-11.11.0.tgz
package-lock.json:832
https://registry.npmjs.org/@metamask/utils/-/utils-5.0.2.tgz
package-lock.json:415
https://registry.npmjs.org/@metamask/utils/-/utils-5.0.2.tgz
package-lock.json:4724
https://registry.npmjs.org/@metamask/utils/-/utils-8.5.0.tgz
package-lock.json:362
https://registry.npmjs.org/@metamask/utils/-/utils-8.5.0.tgz
package-lock.json:492
https://registry.npmjs.org/@metamask/utils/-/utils-8.5.0.tgz
package-lock.json:541
https://registry.npmjs.org/@metamask/utils/-/utils-8.5.0.tgz
package-lock.json:653
https://registry.npmjs.org/@metamask/utils/-/utils-9.3.0.tgz
package-lock.json:395
https://registry.npmjs.org/@metamask/utils/-/utils-9.3.0.tgz
package-lock.json:472
https://registry.npmjs.org/@metamask/utils/-/utils-9.3.0.tgz
package-lock.json:633
https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz
package-lock.json:868
https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.2.1.tgz
package-lock.json:1002
https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.2.1.tgz
package-lock.json:1370
https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.2.1.tgz
package-lock.json:1690
https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.2.1.tgz
package-lock.json:3574
https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz
package-lock.json:908
https://registry.npmjs.org/@noble/curves/-/curves-1.4.2.tgz
package-lock.json:4799
https://registry.npmjs.org/@noble/curves/-/curves-1.8.0.tgz
package-lock.json:3439
https://registry.npmjs.org/@noble/curves/-/curves-1.8.1.tgz
package-lock.json:1014
https://registry.npmjs.org/@noble/curves/-/curves-1.8.1.tgz
package-lock.json:1382
https://registry.npmjs.org/@noble/curves/-/curves-1.8.1.tgz
package-lock.json:1702
https://registry.npmjs.org/@noble/curves/-/curves-1.8.1.tgz
package-lock.json:3586
https://registry.npmjs.org/@noble/curves/-/curves-1.9.1.tgz
package-lock.json:920
https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz
package-lock.json:4565
https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz
package-lock.json:58
https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz
package-lock.json:177
https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz
package-lock.json:4811
https://registry.npmjs.org/@noble/hashes/-/hashes-1.7.0.tgz
package-lock.json:3454
https://registry.npmjs.org/@noble/hashes/-/hashes-1.7.1.tgz
package-lock.json:1029
https://registry.npmjs.org/@noble/hashes/-/hashes-1.7.1.tgz
package-lock.json:1397
https://registry.npmjs.org/@noble/hashes/-/hashes-1.7.1.tgz
package-lock.json:1717
https://registry.npmjs.org/@noble/hashes/-/hashes-1.7.1.tgz
package-lock.json:3601
https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz
package-lock.json:99
https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz
package-lock.json:218
https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz
package-lock.json:935
https://registry.npmjs.org/@paulmillr/qr/-/qr-0.2.1.tgz
package-lock.json:947
https://registry.npmjs.org/@reown/appkit-common/-/appkit-common-1.7.8.tgz
package-lock.json:978
https://registry.npmjs.org/@reown/appkit-controllers/-/appkit-controllers-1.7.8.tgz
package-lock.json:989
https://registry.npmjs.org/@reown/appkit-pay/-/appkit-pay-1.7.8.tgz
package-lock.json:1301
https://registry.npmjs.org/@reown/appkit-polyfills/-/appkit-polyfills-1.7.8.tgz
package-lock.json:1315
https://registry.npmjs.org/@reown/appkit-scaffold-ui/-/appkit-scaffold-ui-1.7.8.tgz
package-lock.json:1324
https://registry.npmjs.org/@reown/appkit-ui/-/appkit-ui-1.7.8.tgz
package-lock.json:1338
https://registry.npmjs.org/@reown/appkit-utils/-/appkit-utils-1.7.8.tgz
package-lock.json:1351
https://registry.npmjs.org/@reown/appkit-wallet/-/appkit-wallet-1.7.8.tgz
package-lock.json:1669
https://registry.npmjs.org/@reown/appkit/-/appkit-1.7.8.tgz
package-lock.json:957
https://registry.npmjs.org/@safe-global/safe-apps-provider/-/safe-apps-provider-0.18.6.tgz
package-lock.json:1989
https://registry.npmjs.org/@safe-global/safe-apps-sdk/-/safe-apps-sdk-9.1.0.tgz
package-lock.json:1999
https://registry.npmjs.org/@safe-global/safe-gateway-typescript-sdk/-/safe-gateway-typescript-sdk-3.23.1.tgz
package-lock.json:2009
https://registry.npmjs.org/@scure/base/-/base-1.1.9.tgz
package-lock.json:4823
https://registry.npmjs.org/@scure/base/-/base-1.2.6.tgz
package-lock.json:2019
https://registry.npmjs.org/@scure/bip32/-/bip32-1.4.0.tgz
package-lock.json:4832
https://registry.npmjs.org/@scure/bip32/-/bip32-1.6.2.tgz
package-lock.json:1041
https://registry.npmjs.org/@scure/bip32/-/bip32-1.6.2.tgz
package-lock.json:1409
https://registry.npmjs.org/@scure/bip32/-/bip32-1.6.2.tgz
package-lock.json:1729
https://registry.npmjs.org/@scure/bip32/-/bip32-1.6.2.tgz
package-lock.json:3613
https://registry.npmjs.org/@scure/bip32/-/bip32-1.7.0.tgz
package-lock.json:2028
https://registry.npmjs.org/@scure/bip39/-/bip39-1.3.0.tgz
package-lock.json:4846
https://registry.npmjs.org/@scure/bip39/-/bip39-1.5.4.tgz
package-lock.json:1055
https://registry.npmjs.org/@scure/bip39/-/bip39-1.5.4.tgz
package-lock.json:1423
https://registry.npmjs.org/@scure/bip39/-/bip39-1.5.4.tgz
package-lock.json:1743
https://registry.npmjs.org/@scure/bip39/-/bip39-1.5.4.tgz
package-lock.json:3627
https://registry.npmjs.org/@scure/bip39/-/bip39-1.6.0.tgz
package-lock.json:2042
https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz
package-lock.json:2055
https://registry.npmjs.org/@solana-program/compute-budget/-/compute-budget-0.11.0.tgz
package-lock.json:2061
https://registry.npmjs.org/@solana-program/system/-/system-0.10.0.tgz
package-lock.json:2070
https://registry.npmjs.org/@solana-program/token-2022/-/token-2022-0.6.1.tgz
package-lock.json:2088
https://registry.npmjs.org/@solana-program/token/-/token-0.9.0.tgz
package-lock.json:2079
https://registry.npmjs.org/@solana/accounts/-/accounts-5.5.1.tgz
package-lock.json:2098
https://registry.npmjs.org/@solana/addresses/-/addresses-5.5.1.tgz
package-lock.json:2123
https://registry.npmjs.org/@solana/assertions/-/assertions-5.5.1.tgz
package-lock.json:2147
https://registry.npmjs.org/@solana/codecs-core/-/codecs-core-5.5.1.tgz
package-lock.json:2191
https://registry.npmjs.org/@solana/codecs-data-structures/-/codecs-data-structures-5.5.1.tgz
package-lock.json:2211
https://registry.npmjs.org/@solana/codecs-numbers/-/codecs-numbers-5.5.1.tgz
package-lock.json:2233
https://registry.npmjs.org/@solana/codecs-strings/-/codecs-strings-5.5.1.tgz
package-lock.json:2254
https://registry.npmjs.org/@solana/codecs/-/codecs-5.5.1.tgz
package-lock.json:2167
https://registry.npmjs.org/@solana/errors/-/errors-5.5.1.tgz
package-lock.json:2280
https://registry.npmjs.org/@solana/fast-stable-stringify/-/fast-stable-stringify-5.5.1.tgz
package-lock.json:2304
https://registry.npmjs.org/@solana/functional/-/functional-5.5.1.tgz
package-lock.json:2321
https://registry.npmjs.org/@solana/instruction-plans/-/instruction-plans-5.5.1.tgz
package-lock.json:2338
https://registry.npmjs.org/@solana/instructions/-/instructions-5.5.1.tgz
package-lock.json:2363
https://registry.npmjs.org/@solana/keys/-/keys-5.5.1.tgz
package-lock.json:2384
https://registry.npmjs.org/@solana/kit/-/kit-5.5.1.tgz
package-lock.json:2408
https://registry.npmjs.org/@solana/nominal-types/-/nominal-types-5.5.1.tgz
package-lock.json:2449
https://registry.npmjs.org/@solana/offchain-messages/-/offchain-messages-5.5.1.tgz
package-lock.json:2466
https://registry.npmjs.org/@solana/options/-/options-5.5.1.tgz
package-lock.json:2493
https://registry.npmjs.org/@solana/plugin-core/-/plugin-core-5.5.1.tgz
package-lock.json:2517
https://registry.npmjs.org/@solana/programs/-/programs-5.5.1.tgz
package-lock.json:2534
https://registry.npmjs.org/@solana/promises/-/promises-5.5.1.tgz
package-lock.json:2555
https://registry.npmjs.org/@solana/rpc-api/-/rpc-api-5.5.1.tgz
package-lock.json:2600
https://registry.npmjs.org/@solana/rpc-parsed-types/-/rpc-parsed-types-5.5.1.tgz
package-lock.json:2630
https://registry.npmjs.org/@solana/rpc-spec-types/-/rpc-spec-types-5.5.1.tgz
package-lock.json:2668
https://registry.npmjs.org/@solana/rpc-spec/-/rpc-spec-5.5.1.tgz
package-lock.json:2647
https://registry.npmjs.org/@solana/rpc-subscriptions-api/-/rpc-subscriptions-api-5.5.1.tgz
package-lock.json:2715
https://registry.npmjs.org/@solana/rpc-subscriptions-channel-websocket/-/rpc-subscriptions-channel-websocket-5.5.1.tgz
package-lock.json:2741
https://registry.npmjs.org/@solana/rpc-subscriptions-spec/-/rpc-subscriptions-spec-5.5.1.tgz
package-lock.json:2765
https://registry.npmjs.org/@solana/rpc-subscriptions/-/rpc-subscriptions-5.5.1.tgz
package-lock.json:2685
https://registry.npmjs.org/@solana/rpc-transformers/-/rpc-transformers-5.5.1.tgz
package-lock.json:2788
https://registry.npmjs.org/@solana/rpc-transport-http/-/rpc-transport-http-5.5.1.tgz
package-lock.json:2812
https://registry.npmjs.org/@solana/rpc-types/-/rpc-types-5.5.1.tgz
package-lock.json:2835
https://registry.npmjs.org/@solana/rpc/-/rpc-5.5.1.tgz
package-lock.json:2572
https://registry.npmjs.org/@solana/signers/-/signers-5.5.1.tgz
package-lock.json:2860
https://registry.npmjs.org/@solana/subscribable/-/subscribable-5.5.1.tgz
package-lock.json:2888
https://registry.npmjs.org/@solana/sysvars/-/sysvars-5.5.1.tgz
package-lock.json:2908
https://registry.npmjs.org/@solana/transaction-confirmation/-/transaction-confirmation-5.5.1.tgz
package-lock.json:2931
https://registry.npmjs.org/@solana/transaction-messages/-/transaction-messages-5.5.1.tgz
package-lock.json:2960
https://registry.npmjs.org/@solana/transactions/-/transactions-5.5.1.tgz
package-lock.json:2988
https://registry.npmjs.org/@solana/wallet-standard-features/-/wallet-standard-features-1.3.0.tgz
package-lock.json:3019
https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.100.14.tgz
package-lock.json:3032
https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.100.14.tgz
package-lock.json:3043
https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz
package-lock.json:3060
https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz
package-lock.json:3069
https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz
package-lock.json:3075
https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz
package-lock.json:3081
https://registry.npmjs.org/@wagmi/connectors/-/connectors-6.2.0.tgz
package-lock.json:3087
https://registry.npmjs.org/@wagmi/core/-/core-2.22.1.tgz
package-lock.json:3117
https://registry.npmjs.org/@wallet-standard/app/-/app-1.1.0.tgz
package-lock.json:3173
https://registry.npmjs.org/@wallet-standard/base/-/base-1.1.0.tgz
package-lock.json:3185
https://registry.npmjs.org/@wallet-standard/features/-/features-1.1.0.tgz
package-lock.json:3194
https://registry.npmjs.org/@walletconnect/core/-/core-2.21.0.tgz
package-lock.json:1068
https://registry.npmjs.org/@walletconnect/core/-/core-2.21.0.tgz
package-lock.json:1436
https://registry.npmjs.org/@walletconnect/core/-/core-2.21.0.tgz
package-lock.json:1756
https://registry.npmjs.org/@walletconnect/core/-/core-2.21.1.tgz
package-lock.json:3206
https://registry.npmjs.org/@walletconnect/environment/-/environment-1.0.1.tgz
package-lock.json:3234
https://registry.npmjs.org/@walletconnect/ethereum-provider/-/ethereum-provider-2.21.1.tgz
package-lock.json:3249
https://registry.npmjs.org/@walletconnect/events/-/events-1.0.1.tgz
package-lock.json:3269
https://registry.npmjs.org/@walletconnect/heartbeat/-/heartbeat-1.2.2.tgz
package-lock.json:3285
https://registry.npmjs.org/@walletconnect/jsonrpc-http-connection/-/jsonrpc-http-connection-1.0.8.tgz
package-lock.json:3296
https://registry.npmjs.org/@walletconnect/jsonrpc-provider/-/jsonrpc-provider-1.0.14.tgz
package-lock.json:3317
https://registry.npmjs.org/@walletconnect/jsonrpc-types/-/jsonrpc-types-1.0.4.tgz
package-lock.json:3328
https://registry.npmjs.org/@walletconnect/jsonrpc-utils/-/jsonrpc-utils-1.0.8.tgz
package-lock.json:3338
https://registry.npmjs.org/@walletconnect/jsonrpc-ws-connection/-/jsonrpc-ws-connection-1.0.16.tgz
package-lock.json:3355
https://registry.npmjs.org/@walletconnect/keyvaluestorage/-/keyvaluestorage-1.1.1.tgz
package-lock.json:3388
https://registry.npmjs.org/@walletconnect/logger/-/logger-2.1.2.tgz
package-lock.json:3407
https://registry.npmjs.org/@walletconnect/relay-api/-/relay-api-1.0.11.tgz
package-lock.json:3417
https://registry.npmjs.org/@walletconnect/relay-auth/-/relay-auth-1.1.0.tgz
package-lock.json:3426
https://registry.npmjs.org/@walletconnect/safe-json/-/safe-json-1.0.2.tgz
package-lock.json:3466
https://registry.npmjs.org/@walletconnect/sign-client/-/sign-client-2.21.0.tgz
package-lock.json:1096
https://registry.npmjs.org/@walletconnect/sign-client/-/sign-client-2.21.0.tgz
package-lock.json:1464
https://registry.npmjs.org/@walletconnect/sign-client/-/sign-client-2.21.0.tgz
package-lock.json:1784
https://registry.npmjs.org/@walletconnect/sign-client/-/sign-client-2.21.1.tgz
package-lock.json:3481
https://registry.npmjs.org/@walletconnect/time/-/time-1.0.2.tgz
package-lock.json:3499
https://registry.npmjs.org/@walletconnect/types/-/types-2.21.0.tgz
package-lock.json:1114
https://registry.npmjs.org/@walletconnect/types/-/types-2.21.0.tgz
package-lock.json:1482
https://registry.npmjs.org/@walletconnect/types/-/types-2.21.0.tgz
package-lock.json:1802
https://registry.npmjs.org/@walletconnect/types/-/types-2.21.1.tgz
package-lock.json:3514
https://registry.npmjs.org/@walletconnect/universal-provider/-/universal-provider-2.21.0.tgz
package-lock.json:1128
https://registry.npmjs.org/@walletconnect/universal-provider/-/universal-provider-2.21.0.tgz
package-lock.json:1496
https://registry.npmjs.org/@walletconnect/universal-provider/-/universal-provider-2.21.0.tgz
package-lock.json:1816
https://registry.npmjs.org/@walletconnect/universal-provider/-/universal-provider-2.21.1.tgz
package-lock.json:3528
https://registry.npmjs.org/@walletconnect/utils/-/utils-2.21.0.tgz
package-lock.json:1149
https://registry.npmjs.org/@walletconnect/utils/-/utils-2.21.0.tgz
package-lock.json:1517
https://registry.npmjs.org/@walletconnect/utils/-/utils-2.21.0.tgz
package-lock.json:1837
https://registry.npmjs.org/@walletconnect/utils/-/utils-2.21.1.tgz
package-lock.json:3549
https://registry.npmjs.org/@walletconnect/window-getters/-/window-getters-1.0.1.tgz
package-lock.json:3767
https://registry.npmjs.org/@walletconnect/window-metadata/-/window-metadata-1.0.1.tgz
package-lock.json:3782
https://registry.npmjs.org/abitype/-/abitype-1.0.6.tgz
package-lock.json:131
https://registry.npmjs.org/abitype/-/abitype-1.0.8.tgz
package-lock.json:1204
https://registry.npmjs.org/abitype/-/abitype-1.0.8.tgz
package-lock.json:1572
https://registry.npmjs.org/abitype/-/abitype-1.0.8.tgz
package-lock.json:1892
https://registry.npmjs.org/abitype/-/abitype-1.0.8.tgz
package-lock.json:3640
https://registry.npmjs.org/abitype/-/abitype-1.2.3.tgz
package-lock.json:3798
https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz
package-lock.json:3819
https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz
package-lock.json:3848
https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz
package-lock.json:3832
https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz
package-lock.json:3865
https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz
package-lock.json:3874
https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz
package-lock.json:3889
https://registry.npmjs.org/async-mutex/-/async-mutex-0.2.6.tgz
package-lock.json:3902
https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz
package-lock.json:3911
https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz
package-lock.json:3917
https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz
package-lock.json:3926
https://registry.npmjs.org/axios-retry/-/axios-retry-4.5.0.tgz
package-lock.json:3952
https://registry.npmjs.org/axios/-/axios-1.16.0.tgz
package-lock.json:3941
https://registry.npmjs.org/base-x/-/base-x-5.0.1.tgz
package-lock.json:3964
https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz
package-lock.json:3970
https://registry.npmjs.org/big.js/-/big.js-6.2.2.tgz
package-lock.json:3990
https://registry.npmjs.org/bn.js/-/bn.js-5.2.3.tgz
package-lock.json:4003
https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz
package-lock.json:4009
https://registry.npmjs.org/bowser/-/bowser-2.14.1.tgz
package-lock.json:4033
https://registry.npmjs.org/bs58/-/bs58-6.0.0.tgz
package-lock.json:4039
https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz
package-lock.json:4048
https://registry.npmjs.org/bufferutil/-/bufferutil-4.1.0.tgz
package-lock.json:4072
https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz
package-lock.json:4085
https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz
package-lock.json:4112
https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz
package-lock.json:4094
https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz
package-lock.json:4125
https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz
package-lock.json:4141
https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz
package-lock.json:4168
https://registry.npmjs.org/charenc/-/charenc-0.0.2.tgz
package-lock.json:4180
https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz
package-lock.json:4189
https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz
package-lock.json:4204
https://registry.npmjs.org/clsx/-/clsx-1.2.1.tgz
package-lock.json:4215
https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz
package-lock.json:4224
https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz
package-lock.json:4236
https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz
package-lock.json:4242
https://registry.npmjs.org/commander/-/commander-14.0.2.tgz
package-lock.json:4254
https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz
package-lock.json:4263
https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz
package-lock.json:4276
https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz
package-lock.json:6937
https://registry.npmjs.org/cookie-es/-/cookie-es-1.2.3.tgz
package-lock.json:4294
https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz
package-lock.json:4300
https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz
package-lock.json:4285
https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz
package-lock.json:4309
https://registry.npmjs.org/cors/-/cors-2.8.6.tgz
package-lock.json:4315
https://registry.npmjs.org/crc-32/-/crc-32-1.2.2.tgz
package-lock.json:4332
https://registry.npmjs.org/cross-fetch/-/cross-fetch-3.2.0.tgz
package-lock.json:3308
https://registry.npmjs.org/cross-fetch/-/cross-fetch-4.1.0.tgz
package-lock.json:4344
https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz
package-lock.json:4353
https://registry.npmjs.org/crossws/-/crossws-0.3.5.tgz
package-lock.json:4367
https://registry.npmjs.org/crypt/-/crypt-0.0.2.tgz
package-lock.json:4376
https://registry.npmjs.org/date-fns/-/date-fns-2.30.0.tgz
package-lock.json:4385
https://registry.npmjs.org/dayjs/-/dayjs-1.11.13.tgz
package-lock.json:4401
https://registry.npmjs.org/debug/-/debug-4.3.4.tgz
package-lock.json:768
https://registry.npmjs.org/debug/-/debug-4.3.4.tgz
package-lock.json:800
https://registry.npmjs.org/debug/-/debug-4.4.3.tgz
package-lock.json:4407
https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz
package-lock.json:4424
https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.2.tgz
package-lock.json:4433
https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz
package-lock.json:4442
https://registry.npmjs.org/defu/-/defu-6.1.7.tgz
package-lock.json:4459
https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz
package-lock.json:4465
https://registry.npmjs.org/depd/-/depd-2.0.0.tgz
package-lock.json:4474
https://registry.npmjs.org/derive-valtio/-/derive-valtio-0.1.0.tgz
package-lock.json:4483
https://registry.npmjs.org/destr/-/destr-2.0.5.tgz
package-lock.json:4492
https://registry.npmjs.org/detect-browser/-/detect-browser-5.3.0.tgz
package-lock.json:4498
https://registry.npmjs.org/dijkstrajs/-/dijkstrajs-1.0.3.tgz
package-lock.json:4504
https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz
package-lock.json:4510
https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz
package-lock.json:4522
https://registry.npmjs.org/duplexify/-/duplexify-4.1.3.tgz
package-lock.json:4536
https://registry.npmjs.org/eciesjs/-/eciesjs-0.4.18.tgz
package-lock.json:4548
https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz
package-lock.json:4580
https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz
package-lock.json:4586
https://registry.npmjs.org/encode-utf8/-/encode-utf8-1.0.3.tgz
package-lock.json:4592
https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz
package-lock.json:4598
https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz
package-lock.json:4607
https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.5.tgz
package-lock.json:4616
https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.2.3.tgz
package-lock.json:4629
https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz
package-lock.json:4638
https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz
package-lock.json:4647
https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz
package-lock.json:4656
https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz
package-lock.json:4668
https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.33.0.tgz
package-lock.json:4683
https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz
package-lock.json:4693
https://registry.npmjs.org/etag/-/etag-1.8.1.tgz
package-lock.json:4699
https://registry.npmjs.org/eth-block-tracker/-/eth-block-tracker-7.1.0.tgz
package-lock.json:4708
https://registry.npmjs.org/eth-json-rpc-filters/-/eth-json-rpc-filters-6.0.1.tgz
package-lock.json:4740
https://registry.npmjs.org/eth-query/-/eth-query-2.1.2.tgz
package-lock.json:4768
https://registry.npmjs.org/eth-rpc-errors/-/eth-rpc-errors-4.0.3.tgz
package-lock.json:4778
https://registry.npmjs.org/ethereum-cryptography/-/ethereum-cryptography-2.2.1.tgz
package-lock.json:4787
https://registry.npmjs.org/eventemitter2/-/eventemitter2-6.4.9.tgz
package-lock.json:4859
https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.1.tgz
package-lock.json:4865
https://registry.npmjs.org/events/-/events-3.3.0.tgz
package-lock.json:4871
https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.0.8.tgz
package-lock.json:4892
https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz
package-lock.json:4880
https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz
package-lock.json:4944
https://registry.npmjs.org/express/-/express-5.2.1.tgz
package-lock.json:4901
https://registry.npmjs.org/extension-port-stream/-/extension-port-stream-3.0.0.tgz
package-lock.json:4962
https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz
package-lock.json:4975
https://registry.npmjs.org/fast-redact/-/fast-redact-3.5.0.tgz
package-lock.json:4981
https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz
package-lock.json:4990
https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz
package-lock.json:4996
https://registry.npmjs.org/filter-obj/-/filter-obj-1.1.0.tgz
package-lock.json:5012
https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz
package-lock.json:5021
https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz
package-lock.json:5042
https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz
package-lock.json:5055
https://registry.npmjs.org/for-each/-/for-each-0.3.5.tgz
package-lock.json:5075

Linked repositories 3

GitHub repositories it links to or installs from, and whether their names can be taken over.

chalk/ansi-styles
url · not tracked
chalk/chalk
url · not tracked
walletconnect/walletconnect-monorepo
url · not tracked
Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

The server signs USDC payments with the user's X402_PRIVATE_KEY via payFetch to resource URLs taken from the remote discovery feed, with no per-call user confirmation, so a compromised or malicious feed entry can spend funds up to the price cap.

mcp-server.js:123
resp = await payFetch(url.toString());
Why it was refuted

Paying for x402 resources with the user's own wallet key is the server's core purpose, and the key is the user's own credential for that service. Spending is capped per call by a pre-check against MAX_PRICE_USD, and the payment wrapper is also built with the same cap. The key is not sent anywhere beyond signing payments, so the harm gate fails.

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

dynamic_metadata line 103: tools list returned by ListToolsRequestSchema handler is computed
mcp-server.js
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
package.json