Evidence row 1261844

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://x402.agentharbor.agency/package-check"
    ]
  ],
  "name": "ah-package-check",
  "owner_address": "0x840c829530df7b4ccf700fa3a0060cf2c80b014e",
  "raw": {
    "accepts": [
      {
        "amount": "3000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x840C829530DF7B4CCF700Fa3A0060cF2C80b014e",
        "scheme": "exact"
      }
    ],
    "description": "Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "ecosystem": "pypi",
              "name": "requests",
              "version": "2.25.0"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "data": {
                "attribution": "Vulnerability data from OSV.dev (https://osv.dev, CC-BY 4.0); package metadata from deps.dev (https://deps.dev, CC-BY 4.0).",
                "deprecated": false,
                "deprecated_reason": null,
                "ecosystem": "pypi",
                "is_latest": false,
                "latest_version": "2.34.2",
                "licenses": [
                  "Apache-2.0"
                ],
                "links": {
                  "documentation": "https://requests.readthedocs.io",
                  "source_repo": "https://github.com/psf/requests"
                },
                "max_severity": "MODERATE",
                "name": "requests",
                "published_at": "2020-11-11",
                "recommendation": "upgrade: known vulnerabilities in this version",
                "sources": [
                  "https://api.deps.dev/v3/systems/PYPI/packages/requests",
                  "https://api.deps.dev/v3/systems/PYPI/packages/requests/versions/2.25.0"
                ],
                "version": "2.25.0",
                "vulnerabilities": [
                  {
                    "aliases": [
                      "CVE-2024-47081",
                      "PYSEC-2026-1872"
                    ],
                    "fixed_in": [
                      "2.32.4"
                    ],
                    "id": "GHSA-9hjg-9r4m-mvj7",
                    "published": "2025-06-09",
                    "severity": "MODERATE",
                    "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
                    "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
                  },
                  {
                    "aliases": [
                      "CVE-2024-35195",
                      "PYSEC-2026-1873"
                    ],
                    "fixed_in": [
                      "2.32.0"
                    ],
                    "id": "GHSA-9wx4-h78v-vm56",
                    "published": "2024-05-20",
                    "severity": "MODERATE",
                    "summary": "Requests `Session` object does not verify requests after making first request with verify=False",
                    "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
                  }
                ],
                "vulnerability_count": 8,
                "vulnerability_count_is_lower_bound": false
              },
              "price_paid_usdc": 0.003,
              "product": "package_check",
              "provider": "Agent Harbor — public-data service",
              "tier": "package-check"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET",
                    "HEAD",
                    "DELETE"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "additionalProperties": false,
                  "properties": {
                    "ecosystem": {
                      "description": "Package registry",
                      "enum": [
                        "pypi",
                        "npm",
                        "go",
                        "cargo",
                        "maven",
                        "nuget",
                        "rubygems"
                      ],
                      "type": "string"
                    },
                    "name": {
                      "description": "Package name as published, e.g. requests or @types/node",
                      "maxLength": 214,
                      "type": "string"
                    },
                    "version": {
                      "description": "Exact version; omit for the latest",
                      "maxLength": 100,
                      "type": "string"
                    }
                  },
                  "required": [
                    "ecosystem",
                    "name"
                  ],
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-30T11:20:49.393Z",
    "quality": {
      "l30DaysTotalCalls": 7,
      "l30DaysUniquePayers": 6,
      "lastCalledAt": "2026-10-30T11:20:48.911Z"
    },
    "resource": "https://x402.agentharbor.agency/package-check",
    "serviceName": "ah-package-check",
    "tags": [
      "open-source",
      "vulnerabilities",
      "osv",
      "licenses",
      "dependencies"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Given an open-source package (PyPI, npm, Go, Cargo, Maven, NuGet or RubyGems) and optionally a version, returns its known vulnerabilities from OSV.dev (IDs, CVE aliases, severity, fixed-in versions), license, latest version, publish date and deprecation status from deps.dev, plus a one-line recommendation. For coding agents to call before adding or upgrading a dependency. Not charged if the package or version does not exist."
}

What the leaf hashes

{"body":"1aa8dc92b71d02726b5df9c3d5cc7bfe53926f83f5845c4782d6f6416a6b6f2c","id":1261844,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793385516966684,"prev":125546,"subject":"x402_bazaar:https://x402.agentharbor.agency/package-check","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-30 (243099 rows).

1. 0xd3e1ad974afa28c15a44a31a27c98252787f8b9662db1d73953e09896d836a65
2. 0x58f2eeafdd4f96d5237fc5228dde50bfa1ac4512a4ac415958289cb3e04baa73
3. 0x8a1b5207f175a96cd199b1310935ae6815c3d9a6572e3b1d67fb6c7c6deaa263
4. 0xc00c352029ac266aaa0bfc809074c7bfb914427ff862cda704fe9b631d66e3ee
5. 0xb2abd1bdb7a9dd2b38285d8869faee52ac1fa25b6977fa3263e8143cc0249b89
6. 0xebb805004f338606c60ffa1c8a9b2459dd921a698b32d2233a9ea47229b39fd4
7. 0x57b5f975e91e33051cdf312782f7addfa9e0f75a38d7bbc0413d5e8664dd5e2c
8. 0xb147109d02a7ea858fba6b6ec93955801db2fb39a9b3a18acb93d6cffd34bb89
9. 0xd2435607462c6323a10833f7d95eb441f2898c78ab21fd892a738bf0f17ee7a8
10. 0xf5a204971b1a358097e51e03a0d22adf905537c1e6cc554119e3f289c78800cc
11. 0xfd626689d436765d3e90831a891606bee5c67bf319c29fe75d7e1310b6f1ca3a
12. 0x41785913cf8a748ad4b7f6562cd47054490c6e6361d26689f4b8aeba4a1d3afe
13. 0xc6d56e36bc916fc7c1441d5c6959a1f0ff7bc0a11547893598fdff5ead2b0cb1
14. 0xeba66653f0c009452ec9977578ba573460df3f672595eaa16c1030e3b20ce767
15. 0xf007cd9640267a58ddffce96e27f5682cf5c47530f53dc15dc53e4ccd405c6c9
16. 0xfbe61dc2d59668ac573e5eab865747e21d38bf2fe4c64762beef01f1018a4dea
17. 0x71e74c274b23c9047354edb6dcd2c654415e3986b8bd875dae992996ea12e22b
18. 0x0c43c73b62a5d49ee1444b5dc4195fc5b16b141d3f4458e2e9fbd5fd6ecb367d

Day root

0x0826c7ad6039e06a2360ca0a4a3a4fe7f2626c6dc19f71a37599386f78b39875

Chained

0x36b4c8a1063758f0b8765fa1bdf75fa92fb543cc183add3e261880ee2bd1f822

Published

On Arc Testnet, block 69923247: 0x8704744146c6967c8abc9e9a99de4db7283b29e840922ea83a69b6fe776e6861