Evidence row 425261

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://pkgpulse.letom1176.workers.dev/api/vuln-audit"
    ]
  ],
  "name": "pkgpulse",
  "owner_address": "0xc863b1c6658971ca427e90665dccce90a41a2bc2",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0xc863b1c6658971ca427e90665dccce90a41a2bc2",
        "scheme": "exact"
      }
    ],
    "description": "Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "packages": "lodash@4.17.15,pypi:requests==2.19.0,leftt-padzz"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "summary": {
                "advisories_by_severity": {
                  "critical": 0,
                  "high": 4,
                  "low": 0,
                  "medium": 3
                },
                "clean": 0,
                "malicious": 0,
                "not_found": 1,
                "packages": 3,
                "vulnerable": 2
              },
              "verdict": "STOP: some packages do not exist on their registry (hallucinated, mistyped or removed)",
              "worst_offenders": [
                {
                  "max_severity": "high",
                  "package": "npm:lodash@4.17.15",
                  "upgrade_to": "4.18.0",
                  "vuln_count": 6
                }
              ]
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "packages": {
                      "description": "Comma-separated name@version items; prefix pypi:, go:, crates:, maven: for other ecosystems (npm default)",
                      "type": "string"
                    }
                  },
                  "required": [
                    "packages"
                  ],
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1793015016/bazaar-icons/869d9c207d82ba82.png",
    "lastUpdated": "2026-10-27T04:48:35.89Z",
    "quality": {
      "l30DaysTotalCalls": 2,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-27T04:48:35.575Z"
    },
    "resource": "https://pkgpulse.letom1176.workers.dev/api/vuln-audit",
    "serviceName": "pkgpulse",
    "tags": [
      "vulnerabilities",
      "audit",
      "osv",
      "security",
      "sbom"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Vulnerability scan for a list of packages in one call via OSV.dev: GET ?packages=lodash@4.17.15,pypi:requests==2.19.0,go:github.com/gin-gonic/gin@v1.9.0 (or POST a lockfile). Up to 200 across npm, PyPI, Go, crates.io, Maven and more: per-package advisories, severity, fix versions and upgrade targets; hallucinated and malicious packages flagged. JSON."
}

What the leaf hashes

{"body":"7db3df9db0623f0217aa98b978891797058129bb092207f963502fc8c5da789c","id":425261,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793086108717030,"prev":407468,"subject":"x402_bazaar:https://pkgpulse.letom1176.workers.dev/api/vuln-audit","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0xfe11563cc5d6e0aaa2546d28821e9d611216e081873edf06537f8ccd6cd1c99b
2. 0x6bcc72a25f6586fd3253c63c62fb0479ad00ea0bbd2067d0501d5084d502ec34
3. 0x6fbcf4a0a01e3194c28878040d3144ac36cf5ea95d39ebf87dc0325d8099ce33
4. 0x64f889501b915167f5cdf3c95aeec0fa30a0fdcdbddf45284cb0a3dcbe70ee25
5. 0xd5a1deb1d7267f0fd946cb9b28255b0c3b5ec2734829171584efe0e5cee63aa3
6. 0x596fe722c1a7b480bb895e9691c349ff0340e88a43a5beca6153e57ccd85a075
7. 0x21455e296c7f5b60eff4e738edd52269405a8bb189f50afd6b3270d237256167
8. 0x39e7c5cd97a5170894dbbec77222ff904953bdf8971b59f4f07a8f3a0927bed3
9. 0xaf9b618b2406bab189d487eb86b53a303e210dd1a333202e2092719754b0c147
10. 0x3ca3e31ae9036bcc0149e8dd5233b4994fe6dfd315128f7a458e0a9bddcd0124
11. 0x2e46f3f4a54c5bd4593fdcffcdac06f2162a9caae3cbf2922131682671bb12a1
12. 0x405c03a710a7150f5182f236dbd76258bf856f8cdf3ac954821ac082524f65da
13. 0x56e872147e60f01cdcee33340b018a7ad7be91ec5b5daef0d2c629c3ca13cbd8
14. 0xb5b652bba4a5afca56c21031d89b1c06361563aaf54ccc8541c296ceeb2b66fa

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4