Evidence row 125546

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://x402.agentharbor.agency/package-check"
    ]
  ],
  "name": "ah-package-check",
  "owner_address": "0x840c829530df7b4ccf700fa3a0060cf2c80b014e",
  "raw": {
    "accepts": [
      {
        "amount": "3000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x840C829530DF7B4CCF700Fa3A0060cF2C80b014e",
        "scheme": "exact"
      }
    ],
    "description": "Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "ecosystem": "pypi",
              "name": "requests",
              "version": "2.25.0"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "data": {
                "attribution": "Vulnerability data from OSV.dev (https://osv.dev, CC-BY 4.0); package metadata from deps.dev (https://deps.dev, CC-BY 4.0).",
                "deprecated": false,
                "deprecated_reason": null,
                "ecosystem": "pypi",
                "is_latest": false,
                "latest_version": "2.34.2",
                "licenses": [
                  "Apache-2.0"
                ],
                "links": {
                  "documentation": "https://requests.readthedocs.io",
                  "source_repo": "https://github.com/psf/requests"
                },
                "max_severity": "MODERATE",
                "name": "requests",
                "published_at": "2020-11-11",
                "recommendation": "upgrade: known vulnerabilities in this version",
                "sources": [
                  "https://api.deps.dev/v3/systems/PYPI/packages/requests",
                  "https://api.deps.dev/v3/systems/PYPI/packages/requests/versions/2.25.0"
                ],
                "version": "2.25.0",
                "vulnerabilities": [
                  {
                    "aliases": [
                      "CVE-2024-47081",
                      "PYSEC-2026-1872"
                    ],
                    "fixed_in": [
                      "2.32.4"
                    ],
                    "id": "GHSA-9hjg-9r4m-mvj7",
                    "published": "2025-06-09",
                    "severity": "MODERATE",
                    "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
                    "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
                  },
                  {
                    "aliases": [
                      "CVE-2024-35195",
                      "PYSEC-2026-1873"
                    ],
                    "fixed_in": [
                      "2.32.0"
                    ],
                    "id": "GHSA-9wx4-h78v-vm56",
                    "published": "2024-05-20",
                    "severity": "MODERATE",
                    "summary": "Requests `Session` object does not verify requests after making first request with verify=False",
                    "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
                  }
                ],
                "vulnerability_count": 8,
                "vulnerability_count_is_lower_bound": false
              },
              "price_paid_usdc": 0.003,
              "product": "package_check",
              "provider": "Agent Harbor — public-data service",
              "tier": "package-check"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET",
                    "HEAD",
                    "DELETE"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "additionalProperties": false,
                  "properties": {
                    "ecosystem": {
                      "description": "Package registry",
                      "enum": [
                        "pypi",
                        "npm",
                        "go",
                        "cargo",
                        "maven",
                        "nuget",
                        "rubygems"
                      ],
                      "type": "string"
                    },
                    "name": {
                      "description": "Package name as published, e.g. requests or @types/node",
                      "maxLength": 214,
                      "type": "string"
                    },
                    "version": {
                      "description": "Exact version; omit for the latest",
                      "maxLength": 100,
                      "type": "string"
                    }
                  },
                  "required": [
                    "ecosystem",
                    "name"
                  ],
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-26T00:12:03.561Z",
    "quality": {
      "l30DaysTotalCalls": 6,
      "l30DaysUniquePayers": 5,
      "lastCalledAt": "2026-10-26T00:12:03.083Z"
    },
    "resource": "https://x402.agentharbor.agency/package-check",
    "serviceName": "ah-package-check",
    "tags": [
      "open-source",
      "vulnerabilities",
      "osv",
      "licenses",
      "dependencies"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist."
}

What the leaf hashes

{"body":"d00b829ddc39f4530817e0ce5f12d1f4c2b1367e7fb7327e3b4e2ba26c3d6ae0","id":125546,"kind":"listing","method":"baseline/1","observed_us":1793025626457906,"prev":null,"subject":"x402_bazaar:https://x402.agentharbor.agency/package-check","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0xd9ae5a456da7a3ee568d09e5f9c63edeaae6fb7fb335f9ec5338d74d6137fee6
2. 0x5bceb22db5f99926176de3e49a78ce355ed85a3d73279182b33ff8e1f366bde0
3. 0xfee8d8ca12820fbf526b3076ef37b9f94a4749e7d1185b5ca6a9d4192157bb19
4. 0x254f20d262a447151a6af3948f236fc702dccb7e0ead01b583a524994ffc3488
5. 0x40e819edf7f88af1f23c504ac8ea229e7129011b72c5a7166d8ce44b7953030a
6. 0x5cd9a29152df7161051d3607076546e08211d9a166cc517b7811f45a9b7b04f7
7. 0x981217e38447eaa60395e76a6314eaa994a3d9c378541745c5447757bfa1d5c5
8. 0x99ae804a413b4307bd4811ed9042b6bf49ad169040514fa94bb1c7039a09dd2c
9. 0xae0783d423815cf4c5e7c10904ca1d9501536e43a32443b67a1fd2dca7b96869
10. 0x60b48a1bcbe1b49c2b79abc9db170c07e64ed7296971e4a62ed6c2c279c87576
11. 0xc65997d4cbe46cfb99054bd5df6a660823432d48a8d7d21b0c1bed1df236af25
12. 0x3704bc5ad033a79977899a5ead894cf50c0b8c8432c020959cefe2af561eb5ee
13. 0xcd9e3af1fa905ec61b99ee9442716d7c7a439aecacd018ec229a24def1cabf6b
14. 0x6b927d53caa5125cdba9255612d524976c691f8672796c3f0885ba2c5b3af1ad
15. 0x6dc40f983a3840a0ad927a9ca17f4ff1e3b649a6c735e2a09b140db7c2caf13b
16. 0x703f95866af09c5e5d6ead7411e9a10f964a41a2aff64d4a55ff0053c023a023
17. 0xd0651cb9bc8155eb52b5247d506e74b8a935057dc190ba52091702ac25ed3a40
18. 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae