← The evidence ledger
Evidence row 2202155
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://vuln-intel.x402tookit.com/vuln-package
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 9de3d3b3db9b1b56f8e1f9559e885c91445454eda0968bf4e1922168a31e1667
- Leaf
- 0x46205a8612d299c600addfd596e306325b0f17ad16924ec626f52b9acc393c86
What was observed
{
"endpoints": [
[
"x402",
"https://vuln-intel.x402tookit.com/vuln-package"
]
],
"name": "Vulnerability Intelligence",
"owner_address": "0xb531320805c5bed1d46aeadcf4f008fdf172dbda",
"raw": {
"accepts": [
{
"amount": "20000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM",
"transactionVersions": [
0
]
},
"maxTimeoutSeconds": 300,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "DUPiupXtuox38dcGoXUKer5mAydCzmaHjrbQ66qeEm8s",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:137",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:42161",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
}
],
"description": "Known vulnerabilities for an exact package version (npm, PyPI, Go, Maven...): fixed version, exploited-in-the-wild flag.",
"extensions": {
"bazaar": {
"info": {
"input": {
"method": "GET",
"queryParams": {
"ecosystem": "npm",
"name": "lodash",
"version": "4.17.15"
},
"type": "http"
},
"output": {
"example": {
"advisories": 6,
"asOf": "2026-10-23T03:17:26.291Z",
"degraded": false,
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"exploitedInTheWild": [],
"fixedVersionsListed": [
"4.17.19",
"4.17.21",
"…2 more"
],
"notChecked": [
"whether your code reaches the vulnerable function",
"transitive dependencies",
"…1 more"
],
"package": "npm:lodash@4.17.15",
"reasons": [
"None of the CVEs is in the KEV catalog (checked against CISA's current list).",
"The 'upgrade to' version is the highest fixed version across advisories; confirm compatibility."
],
"source": "OSV.dev + CISA KEV",
"sourceUrl": "https://api.osv.dev",
"summary": "lodash@4.17.15: 6 advisory(ies), worst severity HIGH. Lowest version that clears every listed advisory: 4.18.0.",
"top": [
{
"cves": [
"CVE-2021-23337"
],
"fixedIn": [
"4.17.21"
],
"id": "GHSA-35jh-r3h4-6jhm",
"published": "2021-05-06T16:05:51Z",
"severity": "HIGH",
"summary": "Command Injection in lodash"
},
{
"cves": [
"CVE-2020-8203"
],
"fixedIn": [
"4.17.19"
],
"id": "GHSA-p6mc-m468-83gw",
"published": "2020-07-15T19:15:48Z",
"severity": "HIGH",
"summary": "Prototype Pollution in lodash"
}
],
"upgradeToAtLeast": "4.18.0",
"verdict": "VULNERABLE_HIGH",
"worstSeverity": "HIGH"
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"properties": {
"ecosystem": {
"description": "npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Pub or Hex",
"type": "string"
},
"name": {
"description": "Package name, e.g. lodash",
"type": "string"
},
"version": {
"description": "Exact version, e.g. 4.17.15",
"type": "string"
}
},
"required": [
"ecosystem",
"name",
"version"
],
"type": "object"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"advisories": {
"type": [
"null",
"number"
]
},
"asOf": {
"type": [
"null",
"string"
]
},
"degraded": {
"type": [
"boolean",
"null"
]
},
"disclaimer": {
"type": [
"null",
"string"
]
},
"exploitedInTheWild": {
"type": [
"array",
"null"
]
},
"fixedVersionsListed": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"notChecked": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"package": {
"type": [
"null",
"string"
]
},
"reasons": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"source": {
"type": [
"null",
"string"
]
},
"sourceUrl": {
"type": [
"null",
"string"
]
},
"summary": {
"type": [
"null",
"string"
]
},
"top": {
"items": {
"properties": {
"cves": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"fixedIn": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"id": {
"type": [
"null",
"string"
]
},
"published": {
"type": [
"null",
"string"
]
},
"severity": {
"type": [
"null",
"string"
]
},
"summary": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"type": [
"array",
"null"
]
},
"upgradeToAtLeast": {
"type": [
"null",
"string"
]
},
"verdict": {
"type": [
"null",
"string"
]
},
"worstSeverity": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"lastUpdated": "2026-11-01T22:39:47.675Z",
"quality": {
"l30DaysTotalCalls": 2,
"l30DaysUniquePayers": 1,
"lastCalledAt": "2026-11-01T22:39:47.525Z"
},
"resource": "https://vuln-intel.x402tookit.com/vuln-package",
"serviceName": "Vulnerability Intelligence",
"tags": [
"vulnerabilities",
"supply-chain",
"osv"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Known vulnerabilities for an exact package version (npm, PyPI, Go, Maven...): fixed version, exploited-in-the-wild flag."
}What the leaf hashes
{"body":"9de3d3b3db9b1b56f8e1f9559e885c91445454eda0968bf4e1922168a31e1667","id":2202155,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793646813516152,"prev":null,"subject":"x402_bazaar:https://vuln-intel.x402tookit.com/vuln-package","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (444186 rows).
- 0x462070ddf11d9f5149ddebfcde89ca5844c7dfd155bfd6c52e6b142d22a8a79f
- 0x300e0f6da0af763359ac5ad39d96fb978e784f789c99f5f59ce442f64d9dd7d6
- 0x3b2dfb85f0d08ec9003f40584008b2eb01c8e44316d645c00db4242f1934c7d7
- 0xdb57fd279a26d89713cddf106fb312795a93a4e0e4d173dcefb7ea26476b0ff7
- 0x4fef3811a5f46bbe1ada5ae99d4c40ae49e6d3d65aa4d991d6f813da270ba02d
- 0x4efef06c5584f3a1ba8d6a4223fd5363ae2905027f8588c709ef6d19e2f2c800
- 0xfa58562062f78218a7992fee5bbbb1486d3148ae3d6f3850a1958d051623006d
- 0x3459ceb3c67ed3924058331503ca7243dd695a05d8d85da6e359406ff1c8e74c
- 0x3fbfbead9dd60418e0ac02d4966c367f64d78029e0ea524f6c470821cc3d895b
- 0x0c6e565159e4b5577c99b872830f5da674047aa9e76265b96992308f5382dffe
- 0xd6ce0209d46ce7cf9a6c01eff144cf152770979661afa3b18a877e99ae9d7ef7
- 0x774abba83e59d4a0d725432b7aa65c7fd5dc16c3ba4272951c2f4df287092b69
- 0x95a273bb8932dab7d9961e32e3d3be866bd51e98c7772b268db2595e5869b5c4
- 0x75634d9d67fe6c75f98d15ecdced550aaaa0b303b51c1355fcc39f82416bc504
- 0x3217f821997a6d778dcf0814a25b1296c55ab77710c675e7b15695d25a6ce67d
- 0x8760c227928c5295506cd8606e763f86cf8cd2a549820fab4dc86d29ca0d816d
- 0xa20b9be86af7d690e040c9060a373b2fc5498edf3432f43c26f74fa2febc1e9a
- 0x050f2978b537f7afb21ee1551577cdf146d1c56f4df12d24315ae5e69366b0a4
- 0x365b161a4b68d750dcc4b3ecce1154a2163c87b08762079428e68f0ebb6a754e
- Day root
- 0x78fecaabbe319e56f5c4b80fc02e2052e198ad24781da8832a475ff65f2002d1
- Chained
- 0xdc35957db5d1371ca382b9152878ffece28ec7c5cb4f98fd71ddb367f8b999b2
- Published
- On Arc Testnet, block 70432815: 0x56b814612eb2e3e544153df3e91e1f7199106d1e430c7d8c6b653feeb9ebe9af