← The evidence ledger
Evidence row 2634317
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://saylorinnovations.com/api/vuln/remediation
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 697ab63669c47686400e2ebc6fc2f905fc823f0e3f08accae5ba99c69ef70cea
- Leaf
- 0x2f3dabf85a24a86013ee4856f54ba0d5d98396424473386acd2f4871cb4e7347
What was observed
{
"endpoints": [
[
"x402",
"https://saylorinnovations.com/api/vuln/remediation"
]
],
"name": "Saylor Innovations Dependency Se",
"owner_address": "0xa2a8df0f7caabea4e120a2568118f141569fc8aa",
"raw": {
"accepts": [
{
"amount": "10000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"assetTransferMethod": "eip3009",
"facilitatorOnly": true,
"memo": "saylor:vuln:remediation",
"name": "USD Coin",
"note": "Base settles through an x402 facilitator. Send payload.signature and payload.authorization (EIP-3009); there is no self-submitted path on this network.",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:8453",
"payTo": "0xA2A8dF0f7CaaBEa4e120a2568118f141569fc8aa",
"scheme": "exact"
},
{
"amount": "10000",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"assetTransferMethod": "eip3009",
"facilitatorOnly": true,
"memo": "saylor:vuln:remediation",
"name": "USD Coin",
"note": "Polygon settles through an x402 facilitator. Send payload.signature and payload.authorization (EIP-3009); there is no self-submitted path on this network.",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:137",
"payTo": "0xA2A8dF0f7CaaBEa4e120a2568118f141569fc8aa",
"scheme": "exact"
},
{
"amount": "10000",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"extra": {
"assetTransferMethod": "eip3009",
"facilitatorOnly": true,
"memo": "saylor:vuln:remediation",
"name": "USD Coin",
"note": "Arbitrum settles through an x402 facilitator. Send payload.signature and payload.authorization (EIP-3009); there is no self-submitted path on this network.",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:42161",
"payTo": "0xA2A8dF0f7CaaBEa4e120a2568118f141569fc8aa",
"scheme": "exact"
},
{
"amount": "10000",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "Hc3sdEAsCGQcpgfivywog9uwtk8gUBUZgsxdME1EJy88",
"memo": "saylor:vuln:remediation"
},
"maxTimeoutSeconds": 120,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "7LSjfrJf8fNsB8VA9u7N3WEn25smQLpob3SvyUvXacy7",
"scheme": "exact"
},
{
"amount": "10000",
"asset": "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB",
"extra": {
"feePayer": "Hc3sdEAsCGQcpgfivywog9uwtk8gUBUZgsxdME1EJy88",
"memo": "saylor:vuln:remediation"
},
"maxTimeoutSeconds": 120,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "7LSjfrJf8fNsB8VA9u7N3WEn25smQLpob3SvyUvXacy7",
"scheme": "exact"
}
],
"description": "Turn an npm package-lock.json v2 or v3 into an actionable dependency remediation queue. Analyzes up to 50 installed package versions against live OSV advisories and returns affected lockfile paths, severity, advisory IDs, and candidate fixed versions. Production dependencies are the default; optionally include dev dependencies. No package scripts run, and compatibility is not tested.",
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"lockfile": {
"lockfileVersion": 3,
"name": "agent-service",
"packages": {
"": {
"name": "agent-service",
"version": "1.0.0"
},
"node_modules/lodash": {
"version": "4.17.15"
},
"node_modules/undici": {
"dev": true,
"version": "5.20.0"
}
}
}
},
"bodyType": "json",
"method": "POST",
"type": "http"
},
"output": {
"description": "Illustrative response shape only; timestamp, advisory count and findings are placeholders, not a live scan.",
"example": {
"checked_at": "2026-11-01T12:00:00.000Z",
"limitations": [
"Candidates are based on OSV fixed-version events; application compatibility and runtime behavior were not tested.",
"Only npm package-lock versions 2 and 3 are accepted. Analysis is capped at 50 distinct package/version records; scope.complete reports whether the lockfile was fully covered.",
"Unresolved or unavailable advisory data is not evidence that a package is safe."
],
"packages": 2,
"remediation_candidates": [
{
"action": "Review a listed fixed version, update the lockfile, then run the project test suite.",
"advisory_ids": [
"GHSA-35jh-r3h4-6jhm"
],
"candidate_fixed_versions": [
"4.17.21"
],
"installed_version": "4.17.15",
"lockfile_paths": [
"node_modules/lodash"
],
"name": "lodash",
"severity": "HIGH"
}
],
"results": [],
"scope": {
"analyzed_records": 2,
"complete": true,
"ecosystem": "npm",
"include_dev": false,
"installed_records": 2,
"omitted_records": 0,
"package_lock_version": 3
},
"source": "OSV.dev",
"vulnerable": 1
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"additionalProperties": false,
"properties": {
"includeDev": {
"default": false,
"description": "Include development dependencies; defaults to production dependencies only.",
"type": "boolean"
},
"lockfile": {
"description": "Parsed npm package-lock.json v2 or v3, maximum 200 KB; the service analyzes up to 50 distinct package/version records.",
"properties": {
"lockfileVersion": {
"enum": [
2,
3
],
"type": "integer"
},
"packages": {
"description": "npm lockfile package map; package entries need their installed version and may omit name when it can be read from the node_modules path.",
"type": "object"
}
},
"required": [
"lockfileVersion",
"packages"
],
"type": "object"
}
},
"required": [
"lockfile"
],
"type": "object"
},
"bodyType": {
"const": "json",
"type": "string"
},
"method": {
"enum": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE",
"HEAD"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"description": {
"type": "string"
},
"example": {
"properties": {
"checked_at": {
"description": "Time the check was run (UTC)",
"type": "string"
},
"limitations": {
"description": "Known limits of this result",
"items": {
"type": "string"
},
"type": "array"
},
"packages": {
"description": "Packages",
"type": "integer"
},
"remediation_candidates": {
"description": "Remediation candidates",
"items": {
"properties": {
"action": {
"description": "Action the figures are for",
"type": "string"
},
"advisory_ids": {
"description": "Advisory ids",
"items": {
"type": "string"
},
"type": "array"
},
"candidate_fixed_versions": {
"description": "Candidate fixed versions",
"items": {
"type": "string"
},
"type": "array"
},
"installed_version": {
"description": "Installed version",
"type": "string"
},
"lockfile_paths": {
"description": "Lockfile paths",
"items": {
"type": "string"
},
"type": "array"
},
"name": {
"description": "Name",
"type": "string"
},
"severity": {
"description": "Severity level",
"type": [
"string",
"null"
]
}
},
"required": [
"name",
"installed_version",
"lockfile_paths",
"candidate_fixed_versions",
"advisory_ids",
"action"
],
"type": "object"
},
"type": "array"
},
"results": {
"description": "List of matching results",
"items": {
"type": "object"
},
"type": "array"
},
"scope": {
"description": "Scope the result covers",
"properties": {
"analyzed_records": {
"description": "Analyzed records",
"type": "integer"
},
"complete": {
"type": "boolean"
},
"ecosystem": {
"const": "npm",
"description": "Package ecosystem the record belongs to"
},
"include_dev": {
"description": "Include dev",
"type": "boolean"
},
"installed_records": {
"description": "Installed records",
"type": "integer"
},
"omitted_records": {
"description": "Omitted records",
"type": "integer"
},
"package_lock_version": {
"description": "Package lock version",
"enum": [
2,
3
],
"type": "integer"
}
},
"required": [
"ecosystem",
"package_lock_version",
"include_dev",
"installed_records",
"analyzed_records",
"omitted_records",
"complete"
],
"type": "object"
},
"source": {
"description": "Data source the values come from",
"type": "string"
},
"vulnerable": {
"description": "True when known vulnerabilities apply",
"type": "integer"
}
},
"required": [
"source",
"checked_at",
"scope",
"packages",
"vulnerable",
"remediation_candidates",
"results",
"limitations"
],
"type": "object"
},
"type": {
"const": "json",
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1792548358/bazaar-icons/bc5e2b3d111ebbef.jpg",
"lastUpdated": "2026-11-03T00:06:53.141Z",
"quality": {
"l30DaysTotalCalls": 1,
"l30DaysUniquePayers": 1,
"lastCalledAt": "2026-11-03T00:06:52.836Z"
},
"resource": "https://saylorinnovations.com/api/vuln/remediation",
"serviceName": "Saylor Innovations Dependency Se",
"tags": [
"npm",
"package-lock",
"dependencies",
"vulnerability",
"remediation"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Turn an npm package-lock.json v2 or v3 into an actionable dependency remediation queue. Analyzes up to 50 installed package versions against live OSV advisories and returns affected lockfile paths, severity, advisory IDs, and candidate fixed versions. Production dependencies are the default; optionally include dev dependencies. No package scripts run, and compatibility is not tested."
}What the leaf hashes
{"body":"697ab63669c47686400e2ebc6fc2f905fc823f0e3f08accae5ba99c69ef70cea","id":2634317,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793734514150994,"prev":null,"subject":"x402_bazaar:https://saylorinnovations.com/api/vuln/remediation","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (425475 rows).
- 0x2f3db0287c9865f9a99a049d66a8ae3818298904d5e1a58eb58ae0d3027d4ac6
- 0xaf8933225f34ce8938c6059097cb47b1d1223ab35de91e809f3dc7c5f72c75e5
- 0x4a7b99be3c2a9e346f0fb20950d454b3184df6074c913d1b190149272fb8eb92
- 0x7d9bc2a8bf4e137b46184205bd3ddfa39feb500095d09f06fd9ebae4e15320b1
- 0x75e2f334080f4b8f190ffdc68c3841373219575dfe851058062860321aabab1c
- 0xc40e9197e5becd5346c08a76c4fb71979dcfafb9ab7eb06de5702b9e8c4cc87d
- 0x874731eb72a99659986481781bcfcd35b039d8f1a5b0321506377d3bf0fb46da
- 0xa6a2ea49f2da7f96d48ad56624a21c66657d3e8b32ac274a714451eeb89050ad
- 0xf36845495862e7f44820c9ebc48d576a83d64e295a71a13cf3d7cc3f1845a09e
- 0x16fb5d7a23dbf9c0d99c0ee437f6756f5ee120441b144781cb828e5ed580d807
- 0x2fd3997140d7e146c0667023f3289fd6130a4e689e7090ebd3cfab6a604861ad
- 0x8455b4b7e5ecaa70aa53da04470fe41e0e0365e4edfd954320849b1c24ce31af
- 0x2f64dbba88ce60f5cad9ef597b99adbf687838c05ce885ed581fa95aaf9b1a3f
- 0x2498d172c194baddb2b78ac926b7c8da79833909dc2801e4c25af0c0eeca0f3d
- 0x3553ea75bcf78135f26289b22fcb05dd562af750aceb74fae97aaa66ea2adb8b
- 0xb1804d44f1a591de3b8b8db8fe72e8ab6695e6d154862ee8ea77b6ac2b43b67d
- 0x87df2ed9052c264d606c076742aa7e54b69fc8344b21e972ebcb19d020b7ecf3
- 0x012ad914f3f945da3b6b48eddc7a1388613e4afc04339deb76c609611864e9b9
- 0xe35032d4b064b015fe60638756eeb0bc24e7c7943586468d33349341ee0ed3d6
- Day root
- 0xb646ffa569e24bf8336b0a15a9d98d0a2f1239f58e10c2b18a9d22e43343566a
- Chained
- 0x35e926359fd19031c6b5e08fb3b44f2524386a57c8fdd353336c185603f53d43
- Published
- On Arc Testnet, block 70601990: 0xa5f9dadba13cde129126b950e64b815e6833cb8ff53b75026c9dbe769c3768c7