← The evidence ledger
Evidence row 457309
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://apexfaucet.xyz/api/x402/software-risk
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 60de4e4376459d6d38fa7f966e6c52dec14b114ca4641d44a8f4a38df944d9b5
- Leaf
- 0xcf6efc5b0299f20f488a0e6be93a95e88e2c24572a1f601e8010c9359352b053
What was observed
{
"endpoints": [
[
"x402",
"https://apexfaucet.xyz/api/x402/software-risk"
]
],
"name": "npm package vulnerability check",
"owner_address": "0xd334ab5151c624cada654854e2879903dc4217ed",
"raw": {
"accepts": [
{
"amount": "3000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"credentialTypes": [
"authorization"
],
"name": "USD Coin",
"note": "Sign an EIP-3009 transferWithAuthorization to payTo and send it base64 in PAYMENT-SIGNATURE - we settle it and you pay no gas. Or pay and replay the hash in X-PAYMENT-BASE.",
"replayHeader": "X-PAYMENT-BASE",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0xd334ab5151c624cada654854e2879903dc4217ed",
"scheme": "exact"
},
{
"amount": "3000",
"asset": "0x3600000000000000000000000000000000000000",
"extra": {
"credentialTypes": [
"authorization"
],
"name": "USDC",
"note": "Sign an EIP-3009 transferWithAuthorization to payTo and send it base64 in PAYMENT-SIGNATURE - we settle it and you pay no gas. Or, since USDC is also the native gas token on Arc, send a plain value transfer to payTo and replay the hash in X-PAYMENT-ARC. Finality is instant on inclusion.",
"replayHeader": "X-PAYMENT-ARC",
"rpc": "https://rpc.mainnet.arc.io",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:5042",
"payTo": "0xd334ab5151c624cada654854e2879903dc4217ed",
"scheme": "exact"
},
{
"amount": "3000",
"asset": "0x3600000000000000000000000000000000000000",
"extra": {
"name": "GatewayWalletBatched",
"note": "Circle Gateway nanopayment: pay from your Gateway balance with a gas-free signature (validBefore at least 7 days out). Settled by Circle in batches.",
"verifyingContract": "0x77777777dcc4d5a8b6e418fd04d8997ef11000ee",
"version": "1"
},
"maxTimeoutSeconds": 604900,
"network": "eip155:5042",
"payTo": "0xd334ab5151c624cada654854e2879903dc4217ed",
"scheme": "exact"
},
{
"amount": "3000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "GatewayWalletBatched",
"note": "Circle Gateway nanopayment: pay from your Gateway balance with a gas-free signature (validBefore at least 7 days out). Settled by Circle in batches.",
"verifyingContract": "0x77777777dcc4d5a8b6e418fd04d8997ef11000ee",
"version": "1"
},
"maxTimeoutSeconds": 604900,
"network": "eip155:8453",
"payTo": "0xd334ab5151c624cada654854e2879903dc4217ed",
"scheme": "exact"
},
{
"amount": "3000",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "D93NE2kMj88BPsHfdZZ4A1HX2CGo14Y18Bdb3J4qtD5c"
},
"maxTimeoutSeconds": 300,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "HYiepS7mNCVVKoaDmZLQ6rNtMWHTQqKheM1NLGn1x8kJ",
"scheme": "exact"
},
{
"amount": "10000000000000000",
"asset": "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d",
"extra": {
"credentialTypes": [
"authorization"
],
"decimals": 18,
"minUsd": 0.01,
"name": "World Liberty Financial USD",
"note": "BNB Smart Chain: sign an EIP-3009 transferWithAuthorization in USD1 (18 decimals, EIP-712 name \"World Liberty Financial USD\", version \"1\") to payTo and send it base64 in PAYMENT-SIGNATURE; we settle it and pay the gas. Minimum $0.01 on BNB.",
"symbol": "USD1",
"version": "1"
},
"maxTimeoutSeconds": 300,
"network": "eip155:56",
"payTo": "0xd334AB5151C624cAdA654854E2879903Dc4217eD",
"scheme": "exact"
},
{
"amount": "10000000000000000",
"asset": "0xcE24439F2D9C6a2289F741120FE202248B666666",
"extra": {
"credentialTypes": [
"authorization"
],
"decimals": 18,
"minUsd": 0.01,
"name": "United Stables",
"note": "BNB Smart Chain: sign an EIP-3009 transferWithAuthorization in U (18 decimals, EIP-712 name \"United Stables\", version \"1\") to payTo and send it base64 in PAYMENT-SIGNATURE; we settle it and pay the gas. Minimum $0.01 on BNB.",
"symbol": "U",
"version": "1"
},
"maxTimeoutSeconds": 300,
"network": "eip155:56",
"payTo": "0xd334AB5151C624cAdA654854E2879903Dc4217eD",
"scheme": "exact"
}
],
"description": "Known vulnerabilities for one package version from OSV.dev, with CISA exploited-in-the-wild flag and the fixed version. Should I install this? Pass ?package=lodash&ecosystem=npm&version=4.17.15 (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Hex, Pub) and get every known advisory for that exact version from OSV.dev (GitHub, PyPA, Go and RustSec databases), whether any of them is on CISA's Known Exploited Vulnerabilities list, severity, and the version that fixes each.",
"extensions": {
"bazaar": {
"info": {
"input": {
"discoverable": true,
"method": "GET",
"queryParams": {
"ecosystem": "npm",
"package": "lodash",
"version": "4.17.15"
},
"type": "http"
},
"output": {
"example": {
"data": {
"advisories": 6,
"ecosystem": "npm",
"exploited": 0,
"licenseVerified": true,
"licenseVerifiedOn": "2026-09-30",
"note": "Records copied only from databases licen…",
"ok": true,
"package": "lodash",
"sources": [
{}
],
"verdict": "VULNERABLE: 6 known advisories for this …",
"version": "4.17.15",
"vulnerabilities": [
{}
]
},
"ok": true,
"paid": 0.003
},
"schema": {
"properties": {
"data": {
"type": "object"
},
"ok": {
"type": "boolean"
},
"paid": {
"type": "number"
}
},
"type": "object"
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"properties": {
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"properties": {
"ecosystem": {
"description": "Package ecosystem.",
"enum": [
"npm",
"PyPI",
"Go",
"crates.io",
"Maven",
"NuGet",
"RubyGems",
"Packagist",
"Hex",
"Pub"
],
"type": "string"
},
"package": {
"description": "Package name exactly as the registry has it (Maven: group:artifact).",
"maxLength": 214,
"minLength": 1,
"type": "string"
},
"version": {
"description": "The exact version to check.",
"maxLength": 64,
"minLength": 1,
"type": "string"
}
},
"required": [
"package",
"ecosystem",
"version"
],
"type": "object"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"queryParams"
],
"type": "object"
},
"output": {
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1791909159/bazaar-icons/f4adc3a60c4cd07b.png",
"lastUpdated": "2026-10-27T09:12:20.005Z",
"quality": {
"lastCalledAt": "2026-10-27T09:12:20.005Z"
},
"resource": "https://apexfaucet.xyz/api/x402/software-risk",
"serviceName": "npm package vulnerability check",
"tags": [
"vulnerability",
"security",
"npm",
"cve",
"dependencies"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Known vulnerabilities for one package version from OSV.dev, with CISA exploited-in-the-wild flag and the fixed version. Should I install this? Pass ?package=lodash&ecosystem=npm&version=4.17.15 (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Hex, Pub) and get every known advisory for that exact version from OSV.dev (GitHub, PyPA, Go and RustSec databases), whether any of them is on CISA's Known Exploited Vulnerabilities list, severity, and the version that fixes each."
}What the leaf hashes
{"body":"60de4e4376459d6d38fa7f966e6c52dec14b114ca4641d44a8f4a38df944d9b5","id":457309,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793100972862571,"prev":null,"subject":"x402_bazaar:https://apexfaucet.xyz/api/x402/software-risk","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (273461 rows).
- 0xcf6f5b8ce7c8c5a0f20a6d070a2aed29d6d2f3acc288fcd056c9d69301cbbeec
- 0xf54e5a242bd5c9cb48b8f6c0c71f58b3fc9ec1cfb49ef55d4bbf8b11db41f7d2
- 0x329529e751587d09ed723820e9d6d7562976d2e6b1cb5a94505fef77d0648e4c
- 0xd953b6d92a973352a05f5e8373f1c6fcb9441e66f5e23d19176727255ce9bdf2
- 0x20b81ca18513e88201ed732eb6670f67de180c3a69084e545a25d4bee8498e6c
- 0xc925318cc8c7fcae7421630300a33b5a7aff03b5eb70c9115e842cc3aef55efd
- 0x4aed43671b81302b98f40a1e3584077341f67c0112221ad41e692f347b96daaf
- 0x52c6ffc5bc926bb268f43f048e2dcb8169d5991dc35fe3bf0831c10af69c2b03
- 0xb90a3907438e0d7ec5dae25b075139ee05fdffea7bcdaf341dd7248f4a56bc6d
- 0x265e21bc620afd5f46c449651a2ec139e67fa79e03222ea0e866b26e92d7ffca
- 0x1b795fb9abcd1a676d4c0ff9d91ca003c12e195f5c97f0608cf1bba69a05bb30
- 0x66e8d9e469038ef11a686abeed12c8ceb38a1a8cd79012ccf20d29a30858cbbc
- 0xeb77e9d1884bf470f4a13a5869956a83ac37957112a29ccb9e63ddf7791b5a0b
- 0xcc49fd573532e5a29f5be4033f62a2eff71456c020bd2258312b98e95cfe301e
- 0x969cd44e5a4e8dc3110540398fbf689659eb51df735c1cda5d8f021ef9ff5683
- 0xa94627de1af0e823832e05a9069b304ecccb8c0cdb8f9cfc4f2039bfb9799dc5
- 0xdf1105afdc109de3c09a98fc8a3864159ad964e6f49b635c105a27a1e1f14310
- 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
- 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699
- Day root
- 0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795
- Chained
- 0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4
- Published
- On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4