
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@agentcommercekit/ack-pay
Advanced tools
> Agent-Native Payments Protocol for the Agent Economy
Agent-Native Payments Protocol for the Agent Economy
The Agent Commerce Kit Payment Protocol (ACK-Pay) TypeScript SDK provides tools for creating verifiable payment requests and receipts using W3C Verifiable Credentials.
ACK-Pay is part of the Agent Commerce Kit.
npm i @agentcommercekit/ack-pay
# or
pnpm add @agentcommercekit/ack-pay
import { createPaymentRequestBody } from "@agentcommercekit/ack-pay"
import { createDidWebUri } from "@agentcommercekit/did"
import { createJwtSigner, curveToJwtAlgorithm } from "@agentcommercekit/jwt"
import { generateKeypair } from "@agentcommercekit/keys"
// Create a payment request
const paymentRequest = {
id: "payment-123",
description: "Access to premium content",
paymentOptions: [
{
id: "option-1",
amount: new BigInt(100_000_000).toString(), // 100 USDC
decimals: 6,
currency: "USDC",
recipient: "did:web:payment.example.com",
paymentService: "https://pay.example.com"
}
]
}
const keypair = await generateKeypair("secp256k1")
// Create a payment request body with a signed token
const paymentRequestBody = await createPaymentRequestBody(paymentRequest, {
issuer: createDidWebUri("https://server.example.com"),
signer: createJwtSigner(keypair),
algorithm: curveToJwtAlgorithm(keypair.curve)
})
// Create a 402 Payment Required response
const response = new Response(JSON.stringify(paymentRequestBody, {
status: 402,
contentType: "application/json"
})
import { createPaymentReceipt } from "@agentcommercekit/ack-pay"
const receipt = createPaymentReceipt({
paymentRequestToken: "<payment-token-from-request>",
paymentOptionId: "<payment-option-id-from-request>",
issuer: "did:web:receipt-service.example.com",
payerDid: "did:web:customer.example.com"
})
import { verifyPaymentReceipt } from "@agentcommercekit/ack-pay"
import { getDidResolver } from "@agentcommercekit/did"
const verified = await verifyPaymentReceipt(receipt, {
resolver: getDidResolver(),
trustedIssuers: ["did:web:merchant.example.com"]
})
import { isPaymentRequest } from "@agentcommercekit/ack-pay"
// Check if a value is a valid payment request
isPaymentRequest(unknownObject)
// Check if a credential is specifically a payment receipt credential
isPaymentReceiptCredential(credential)
// Check if a credential subject has the payment receipt claim structure
isPaymentReceiptClaim(credential.credentialSubject)
createPaymentRequestBody(params, options)
- Creates a payment request with a signed JWT tokenisPaymentRequest(value)
- Type guard for payment requestscreatePaymentRequestToken(paymentRequest, options)
- Creates a signed JWT token for a payment requestverifyPaymentRequestToken(token, options)
- Verifies a payment request token JWTcreatePaymentReceipt(params)
- Creates a verifiable credential receiptverifyPaymentReceipt(receipt, options)
- Verifies a payment receipt credentialgetReceiptClaimVerifier()
- Returns a claim verifier for payment receipts// Zod v4 schema
import { paymentRequestSchema } from "@agentcommercekit/ack-pay/schemas/zod/v4"
// Zod v3 schema
import { paymentRequestSchema } from "@agentcommercekit/ack-pay/schemas/zod/v3"
// Valibot schema
import { paymentRequestSchema } from "@agentcommercekit/ack-pay/schemas/valibot"
This SDK supports Agent Commerce Kit version 2025-05-04
.
See the ACK Versioning documentation for more information.
Copyright (c) 2025 Catena Labs, Inc.
FAQs
> Agent-Native Payments Protocol for the Agent Economy
The npm package @agentcommercekit/ack-pay receives a total of 0 weekly downloads. As such, @agentcommercekit/ack-pay popularity was classified as not popular.
We found that @agentcommercekit/ack-pay demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.