← The evidence ledger
Evidence row 1789776
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://verifylite.hydratinghealingtouch.workers.dev/package-check
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 4820380133d9aa4acd626b18ab2082b687cb6c165a38d8868c0ba2be0f7f1210
- Leaf
- 0xcde018e17ddb0b8c590b8b54b690d8b259fc0f2e7d769735ee52d1013c7f0a76
What was observed
{
"endpoints": [
[
"x402",
"https://verifylite.hydratinghealingtouch.workers.dev/package-check"
]
],
"name": "VerifyLite",
"owner_address": "0xb33134504393140cfd963d76f62907d660880932",
"raw": {
"accepts": [
{
"amount": "4100",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0xb33134504393140cfd963d76f62907d660880932",
"scheme": "exact"
},
{
"amount": "4100",
"asset": "0x3600000000000000000000000000000000000000",
"extra": {
"name": "USDC",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:5042",
"payTo": "0xb33134504393140cfd963d76f62907d660880932",
"scheme": "exact"
},
{
"amount": "4100",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:137",
"payTo": "0xb33134504393140cfd963d76f62907d660880932",
"scheme": "exact"
}
],
"description": "Check dependencies for known vulnerabilities before installing or shipping: up to 20 packages (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist and more, by name and version or purl) against the OSV.dev database. Returns each advisory with CVE IDs, severity and CVSS score, fixed versions, the smallest safe upgrade, and links. Not charged for invalid input or if OSV.dev can't be reached.",
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"ecosystem": "npm",
"name": "lodash",
"version": "4.17.15"
},
"bodyType": "json",
"method": "POST",
"type": "http"
},
"output": {
"example": {
"checked": 1,
"packages": [
{
"count": 6,
"highestSeverity": "HIGH",
"package": "npm:lodash@4.17.15",
"upgradeTo": "4.17.21",
"version": "4.17.15",
"vulnerabilities": [
{
"cve": [
"CVE-2021-23337"
],
"cvssScore": 7.2,
"fixedIn": [
"4.17.21"
],
"id": "GHSA-35jh-r3h4-6jhm",
"severity": "HIGH",
"summary": "Command Injection in lodash",
"url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
}
],
"vulnerable": true
}
],
"summary": "1 of 1 package(s) have known vulnerabilities: npm:lodash@4.17.15 (6, highest HIGH).",
"tool": "package_vulnerabilities",
"vulnerable": 1
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"ecosystem": {
"description": "For a single package: npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex...",
"type": "string"
},
"name": {
"description": "For a single package: its name.",
"type": "string"
},
"packages": {
"description": "Up to 20 packages: {\"ecosystem\": \"npm\", \"name\": \"lodash\", \"version\": \"4.17.15\"} or {\"purl\": \"pkg:npm/lodash@4.17.15\"}.",
"type": "array"
},
"purl": {
"description": "Or a package URL, e.g. pkg:npm/lodash@4.17.15.",
"type": "string"
},
"version": {
"description": "For a single package: one exact version (no ranges).",
"type": "string"
}
},
"required": [],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
},
"builder-code": {
"info": {
"a": "bc_jqm094l8",
"s": [
"cdp_sdk_server"
]
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false,
"properties": {
"a": {
"description": "App builder code",
"pattern": "^[a-z0-9_]{1,32}$",
"type": "string"
},
"s": {
"description": "Service builder codes",
"items": {
"pattern": "^[a-z0-9_]{1,32}$",
"type": "string"
},
"maxItems": 11,
"type": "array"
},
"w": {
"description": "Wallet builder code",
"pattern": "^[a-z0-9_]{1,32}$",
"type": "string"
}
},
"type": "object"
}
},
"eip2612GasSponsoring": {},
"erc20ApprovalGasSponsoring": {}
},
"lastUpdated": "2026-11-01T14:28:44.932Z",
"quality": {
"l30DaysTotalCalls": 1,
"l30DaysUniquePayers": 1,
"lastCalledAt": "2026-11-01T14:28:44.803Z"
},
"resource": "https://verifylite.hydratinghealingtouch.workers.dev/package-check",
"serviceName": "VerifyLite",
"tags": [
"vulnerability",
"cve",
"dependencies",
"security",
"supply-chain"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Check dependencies for known vulnerabilities before installing or shipping: up to 20 packages (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist and more, by name and version or purl) against the OSV.dev database. Returns each advisory with CVE IDs, severity and CVSS score, fixed versions, the smallest safe upgrade, and links. Not charged for invalid input or if OSV.dev can't be reached."
}What the leaf hashes
{"body":"4820380133d9aa4acd626b18ab2082b687cb6c165a38d8868c0ba2be0f7f1210","id":1789776,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793559928637836,"prev":null,"subject":"x402_bazaar:https://verifylite.hydratinghealingtouch.workers.dev/package-check","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (302406 rows).
- 0xcde00f06ae3f99dfc659f589a7ca4008261a56b7da3a5f05a76b7d857fc72de2
- 0xab7acdf6772f5a9854e8cae6766c20433180cf11600b42b82df57705b5ae729c
- 0x949e1987cf0a4063c3aaa36da699c6181cd8350188f865a4302aee1f2cb9e948
- 0x168eaba1421e9235eb96b5d01272926a6f8df6bdeb13156f3597d67d024fed77
- 0xa56b7bbd79fe734e4632c76ec74882eeaa2979ef7bf33c3b3d538e60c9bd895b
- 0x67b0243fc55b022f3228c0cf1d0cb90f2955b20578f12b84948e13bce7a7364c
- 0x4c4dc0b73a0eb47b56cddd4ae7647fea8170b56c370b213aefe3676e0505ee1d
- 0xd5be3fd68c5aa911c3926dfbba588ebdb11da31c76ed4c38b3a36d66743ced34
- 0x4af7d11ffd2a6270fdc63aee6d946fc45d59942fd8b8257fb8d47c782d8e3052
- 0x79eb363bc6f462693518a343d0cdccd471b19bce827165b98fc5b61e33f9fef4
- 0xc3c50173aab15b8714084cc0e33f2c973ead213dd8800c3c76a633f673514146
- 0x05c01f6fc841198b106b39a44096c275b4f568fc175b5edacd4ed477dd360592
- 0xdac71a6781318034c1afd4a1a615965f2837dd22d52db9dcf4ff6d934cdde2b9
- 0xc837737eae003d6217621fce98752787bb2b4be80aad499398bcd6fa49bd6996
- 0x537331ef190eaefb4419f2a4558b952aaf9435d759df0b0c118b7df609ec1687
- 0xfc183bee85dc11a067fb710c6eb88824b94a516ddbdf2717b839e672a2206a7e
- 0xb5916fb7a3e87dc0702e46eeadcd22652e2e1e755f8d429cc7a14a67a350b51b
- 0x6142ac48fda269c17791c79da99c2456ac6acfe98268f4d168a404fd6040c703
- 0x3315fd2757fdd435852cc277377234a3f3909a6d2a089d0e36f6d59aacfda910
- Day root
- 0x7fa2cba1cf3d6b35630896f5fe1a650adb307ea2c376e80a5f2d9276b7cb5ab3
- Chained
- 0x577ff89ba012beeff3197bcff7fa86752074bdf54205a24359cc437be2a952a4
- Published
- On Arc Testnet, block 70262758: 0x435bc1b9331471d72e1998f2e420983b5189d4da65ffbd6f27ef40daf5e1ea90