Evidence row 407468

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://pkgpulse.letom1176.workers.dev/api/vuln-audit"
    ]
  ],
  "name": "pkgpulse",
  "owner_address": "0xc863b1c6658971ca427e90665dccce90a41a2bc2",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0xc863b1c6658971ca427e90665dccce90a41a2bc2",
        "scheme": "exact"
      }
    ],
    "description": "Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "packages": "lodash@4.17.15,pypi:requests==2.19.0,leftt-padzz"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "summary": {
                "advisories_by_severity": {
                  "critical": 0,
                  "high": 4,
                  "low": 0,
                  "medium": 3
                },
                "clean": 0,
                "malicious": 0,
                "not_found": 1,
                "packages": 3,
                "vulnerable": 2
              },
              "verdict": "STOP: some packages do not exist on their registry (hallucinated, mistyped or removed)",
              "worst_offenders": [
                {
                  "max_severity": "high",
                  "package": "npm:lodash@4.17.15",
                  "upgrade_to": "4.18.0",
                  "vuln_count": 6
                }
              ]
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "packages": {
                      "description": "Comma-separated name@version items; prefix pypi:, go:, crates:, maven: for other ecosystems (npm default)",
                      "type": "string"
                    }
                  },
                  "required": [
                    "packages"
                  ],
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1793015016/bazaar-icons/869d9c207d82ba82.png",
    "lastUpdated": "2026-10-27T04:48:35.89Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-26T11:43:35.3Z"
    },
    "resource": "https://pkgpulse.letom1176.workers.dev/api/vuln-audit",
    "serviceName": "pkgpulse",
    "tags": [
      "vulnerabilities",
      "audit",
      "osv",
      "security",
      "sbom"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON."
}

What the leaf hashes

{"body":"5d17283e6cd827b5df983ee6a221d858891e2474e08eed4b84a1e2067bd2995d","id":407468,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793080248901965,"prev":17083,"subject":"x402_bazaar:https://pkgpulse.letom1176.workers.dev/api/vuln-audit","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0xdfc68b6cb9ddc3f8d9d30b2abf748a664fa3d9903a0ef0bdbb0fa2d9045e035a
2. 0x13bda59ddb1e37539936d2b2cae2669edd8b21f98393609760aedac35ed0df65
3. 0x8d8a8faf34b1865195cb074d3a699bad492dd9e0a83447552bf182965cffa0c4
4. 0x17bd4059c8ad62cfb672a4b4048867867d784c6ef631f1b8052c077f00abf189
5. 0xbf670aa810d6e0e9e022b2233d72fd75e075d8cc151aaeb7a39463ba335db414
6. 0x1533c976357afd77c8b362262093cc0f4371ab3f783f338ced954ffcd1de5ac4
7. 0x611c4916e75ea8ff816f1c55157045b25fb2716f095f13bfba31a317c2136b5c
8. 0xaf7b573263e78f43fd3b3d1928c3e7710932c1618c9e6644eb47773134ce4f26
9. 0x82c91994046fdeb6842bcd11f43df8905129aa39a9d98c4b04271844c3f52a68
10. 0xf15c4662f158512752b5663d4c94f9e3c5d11789dc4388192e7e6d9c657a39ab
11. 0x9af01ba97e34591efa38acdf7cbe8b47ad3b56f8797520a2c7b8cc01c4c26ae7
12. 0x432466fcdd2910b1cfb374f6f8307f56042f761290246a54c4573b208b574ac2
13. 0x979156f4f0a1ab811055c0a4d2b45bfa74d4bef619c176540454ee8d15e5bebc
14. 0xf72dee7a0c7534cb19ede4959b957b00c0a8285c36ad49dd2ce1c1092bf60d93
15. 0x24e3e2bb8ee1e8d20756de35f0e0c4ec8eb1f193bd2cf3f077ee1f92f211c34d
16. 0x8745bd887f5ce9f7a49558fd2b04cdcd97a05ea9f8a23f62d0e80cb13d328b0f
17. 0xdf1105afdc109de3c09a98fc8a3864159ad964e6f49b635c105a27a1e1f14310
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4