Evidence row 70838

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.youraitools.co/pkgguard/v1/scan"
    ]
  ],
  "name": "PkgGuard by AgentGate",
  "owner_address": "0x3c1a1e01e790cd326495631b3b38bd7068f08d6f",
  "raw": {
    "accepts": [
      {
        "amount": "3000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 120,
        "network": "eip155:8453",
        "payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
        "scheme": "exact"
      },
      {
        "amount": "3000",
        "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 120,
        "network": "eip155:137",
        "payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
        "scheme": "exact"
      },
      {
        "amount": "3000",
        "asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 120,
        "network": "eip155:42161",
        "payTo": "0x3c1A1E01e790Cd326495631B3b38Bd7068F08d6F",
        "scheme": "exact"
      },
      {
        "amount": "3000",
        "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
        "extra": {
          "feePayer": "GVJJ7rdGiXr5xaYbRwRbjfaJL7fmwRygFi1H6aGqDveb"
        },
        "maxTimeoutSeconds": 120,
        "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "payTo": "FH73WbbUe2UyNzfy72MJs5nT3NxyDf9GrqE7kzjL2Jte",
        "scheme": "exact"
      }
    ],
    "description": "Dependency vulnerability scanner API. Dependency security scan for agents and CI: send a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a package list, up to 500). Returns known vulnerabilities (CVE/GHSA ids, severity, CVSS, fixed-in versions) and confirmed-malicious packages per dependency, from OSV.dev. Search intents: dependency vulnerability scan, npm audit api, sca api, lockfile security scan, cve lookup, software supply chain security.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "filename": "package.json",
              "manifest": "{\"name\":\"demo\",\"dependencies\":{\"lodash\":\"4.17.15\",\"flatmap-stream\":\"0.1.1\",\"express\":\"^4.18.2\"}}"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "advisory_count": 9,
              "by_severity": {
                "CRITICAL": 3,
                "HIGH": 3,
                "LOW": 0,
                "MEDIUM": 3,
                "UNKNOWN": 0
              },
              "highest_severity": "CRITICAL",
              "malicious_count": 1,
              "manifest_type": "package.json",
              "package_count": 3,
              "packages": [
                {
                  "ecosystem": "npm",
                  "highest_severity": "CRITICAL",
                  "malicious": true,
                  "name": "flatmap-stream",
                  "version": "0.1.1",
                  "version_source": "exact",
                  "vuln_count": 3,
                  "vulns": [
                    {
                      "fixed_in": [],
                      "id": "MAL-2025-20690",
                      "malicious": true,
                      "severity": "CRITICAL",
                      "summary": "Malicious code in flatmap-stream (npm)",
                      "url": "https://osv.dev/vulnerability/MAL-2025-20690"
                    }
                  ]
                }
              ],
              "range_note": "For version ranges (e.g. ^4.17.0) the lowest allowed version was scanned.",
              "scanned_count": 3,
              "source": {
                "name": "OSV.dev"
              },
              "tier": "full",
              "unpinned_count": 0,
              "verdict": "malicious",
              "vulnerable_count": 2
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "description": "Search intents: dependency vulnerability scan, npm audit api, sca api, lockfile security scan, cve lookup, software supply chain security",
                  "properties": {
                    "filename": {
                      "description": "Optional file name, helps type detection",
                      "type": "string"
                    },
                    "include_dev": {
                      "description": "Include devDependencies (default true)",
                      "type": "boolean"
                    },
                    "manifest": {
                      "description": "Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)",
                      "type": "string"
                    },
                    "packages": {
                      "description": "Alternative to manifest: [{ecosystem, name, version}], up to 500",
                      "items": {
                        "type": "object"
                      },
                      "type": "array"
                    }
                  }
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "properties": {
                    "advisory_count": {
                      "type": "number"
                    },
                    "by_severity": {
                      "type": "object"
                    },
                    "highest_severity": {
                      "type": "string"
                    },
                    "malicious_count": {
                      "type": "number"
                    },
                    "manifest_type": {
                      "type": "string"
                    },
                    "package_count": {
                      "type": "number"
                    },
                    "packages": {
                      "type": "array"
                    },
                    "range_note": {
                      "type": "string"
                    },
                    "scanned_count": {
                      "type": "number"
                    },
                    "source": {
                      "type": "object"
                    },
                    "tier": {
                      "type": "string"
                    },
                    "unpinned_count": {
                      "type": "number"
                    },
                    "verdict": {
                      "type": "string"
                    },
                    "vulnerable_count": {
                      "type": "number"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1792634264/bazaar-icons/24b9b478d3f15ec3.png",
    "lastUpdated": "2026-10-25T00:58:30.39Z",
    "quality": {
      "l30DaysTotalCalls": 3,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-25T00:58:30.174Z"
    },
    "resource": "https://api.youraitools.co/pkgguard/v1/scan",
    "serviceName": "PkgGuard by AgentGate",
    "tags": [
      "security",
      "dependencies",
      "vulnerability-scan",
      "supply-chain",
      "malware"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Dependency vulnerability scanner API. Dependency security scan for agents and CI: send a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a package list, up to 500). Returns known vulnerabilities (CVE/GHSA ids, severity, CVSS, fixed-in versions) and confirmed-malicious packages per dependency, from OSV.dev. Search intents: dependency vulnerability scan, npm audit api, sca api, lockfile security scan, cve lookup, software supply chain security."
}

What the leaf hashes

{"body":"26c1f82ece23a1660c219e7338f82be4272581c1387ef4e9e69e60809f6039eb","id":70838,"kind":"listing","method":"baseline/1","observed_us":1793025480960339,"prev":null,"subject":"x402_bazaar:https://api.youraitools.co/pkgguard/v1/scan","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x00f8873fe893a98ee2bf14a7a33b247a4177e499c79809d9a2638ab07bc923dc
2. 0xa62da4f4c9239dcbc6a96f040efbe579c2bdaed2d611b6b31ec993c4262562d5
3. 0x7330d3d934d937d7b38be99cb04b0a24b931280b9bc2d96a81e9fc1223880e91
4. 0xb3255db2ca49cf0200fcdf9701f29810e9c14291558ad2a463ef15ec4c9f2d29
5. 0x2a7ddfd9f43e698849d3591426554ab2acaa15b110036ee9d2c0dc42d053bddb
6. 0xeb0db7be8a314b5eeffd0c2a0450a3dd53f26d0070ba82f684289c1e7eb9b276
7. 0xd277e65c97f888f4c3db3b2dd7dcf8ff9a5a4ae71efd696c3c75e81210e6e741
8. 0xc44aac0b451ab3a106ea9440891730c429443c0630f1608ebf43faf7df666fd7
9. 0x2fc363c5bba070471eb54f7f068787ab3dde45fba438e19d28a6b3c06783741e
10. 0x0318758518e80d451d4f575531dcd2cc2b24eb8d4c0b8a59ffb33d387428afa1
11. 0xdbc41a9a60a4504b5d2eaf9b4bdc4f7e216ca3dfaa1fe4bcdd27541133e12a2d
12. 0x9d52e830c7a3480876eca1592c3b5c4a56ee3a8c6fdd4e37c57710b7654e36c7
13. 0x92ff7d176556ddbe3d885e2ab73948b14a6aa3568a8fd237427d4f8415235a23
14. 0xd1d3499072edb10edc68f84bcae2365d2ab534df689250cab18c751b6f13b6ff
15. 0x7ddc2fead128357f881b63e6c7c26d7fbbb84fca6c7c8e0bbfe386de86ca8d39
16. 0xc6a4d7899a0f442958e26505011190b7cff2483611c1b94eba9043e0ba9ac36e
17. 0x8c756542e482157df0c36464d75c937b845e4423dbbcfad08f0cf8d5a16b9a13
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae