Evidence row 17083

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://pkgpulse.letom1176.workers.dev/api/vuln-audit"
    ]
  ],
  "name": "pkgpulse",
  "owner_address": "0xc863b1c6658971ca427e90665dccce90a41a2bc2",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0xc863b1c6658971ca427e90665dccce90a41a2bc2",
        "scheme": "exact"
      }
    ],
    "description": "Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "packages": "lodash@4.17.15,pypi:requests==2.19.0,leftt-padzz"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "summary": {
                "advisories_by_severity": {
                  "critical": 0,
                  "high": 4,
                  "low": 0,
                  "medium": 3
                },
                "clean": 0,
                "malicious": 0,
                "not_found": 1,
                "packages": 3,
                "vulnerable": 2
              },
              "verdict": "STOP: some packages do not exist on their registry (hallucinated, mistyped or removed)",
              "worst_offenders": [
                {
                  "max_severity": "high",
                  "package": "npm:lodash@4.17.15",
                  "upgrade_to": "4.18.0",
                  "vuln_count": 6
                }
              ]
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "packages": {
                      "description": "Comma-separated name@version items; prefix pypi:, go:, crates:, maven: for other ecosystems (npm default)",
                      "type": "string"
                    }
                  },
                  "required": [
                    "packages"
                  ],
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1793015016/bazaar-icons/869d9c207d82ba82.png",
    "lastUpdated": "2026-10-26T11:43:35.661Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-26T11:43:35.3Z"
    },
    "resource": "https://pkgpulse.letom1176.workers.dev/api/vuln-audit",
    "serviceName": "pkgpulse",
    "tags": [
      "vulnerabilities",
      "audit",
      "osv",
      "security",
      "sbom"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON."
}

What the leaf hashes

{"body":"ff2de2815800a6a9b85d7b7707615d97644645e1b3fadbb7182320162a4790ed","id":17083,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793025325498013,"prev":null,"subject":"x402_bazaar:https://pkgpulse.letom1176.workers.dev/api/vuln-audit","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0xfb4dc1dac052f240f00868fde32d0c386bea8e966e0481baca19ab419a832015
2. 0x2d8413fee009444dba11df7c994b3d05e75fcf467d8569c6028590a0c021bf80
3. 0xc868b33874723d1847df6962f83809ea6b387f0b36c705eb8648773677eaa188
4. 0xf3a72d2e31e8ab9d24615957cc4cc35c4ba3168249a6fbe583f9fcfe0ddff028
5. 0x43adaf2bada07e0ec81823c9fef363c705dfa74808865b0240602b5d9d12eb39
6. 0x67a6af18eac51f5000e85f3b6c49b54eade901727eddf261572980108fd4ba55
7. 0x126f5228396a46d01ece4be38c6fb6a3407add6534f4791b7126453c5ff2f5fe
8. 0x3621552e4b0ee7b3dd12bfd88c2d154f5358613926310948221abddb0daae8a4
9. 0x58a264708b2de7686001e7a3f193bfa24c3c73c95dc89570827da2e8e66343b8
10. 0x1b07c7876c95e52802884c5d693a686ed53bb8a2740e3d87b145fb511a8d605e
11. 0xcf10f42f956ec0f58e8d60fb00e23c6415064b00d70e8566efe0f1b98e7e1d0a
12. 0xf8173f36b7a27e1bb0f6961a49501bba1d99349c5e11449d0d557fbaa910be0a
13. 0xbee644d57738676bfb20eb90d6021f364bf883a8d54f8d17e9dc4749b4074c3d
14. 0x44945ea9ad8b24e723ad5a8fd6d014024a49531783f74ff9229c2ab6930e84c8
15. 0x68d296b1e00b4899fb83c3fba36fffaefa311eac2903067dbebfe776a12b4a9a
16. 0x5fb5dda563336cd1bc1b9f44c52b76237ae72ed2145cb9290f39f304ca7dd678
17. 0x74a0a08e4e7ab9aa5bfbead33dec7e1c7e8e364cff69a63720d764bbe987aadc

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae