
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@coinbase/x402
Advanced tools
The official Coinbase facilitator package for the x402 Payment Protocol. This package provides direct access to Coinbase's hosted facilitator service, enabling seamless payment verification and settlement.
npm install @coinbase/x402
This package optionally uses CDP API keys from the Coinbase Developer Platform for authenticated operations:
CDP_API_KEY_ID: Your CDP API key IDCDP_API_KEY_SECRET: Your CDP API key secret| Endpoint | Authentication Required | Purpose |
|---|---|---|
list | ❌ No | Discover available bazaar items and payment options |
verify | ✅ Yes | Verify payment transactions |
settle | ✅ Yes | Settle completed payments |
Note: Environment variables are only required when using the verify and settle endpoints. The list endpoint can be used without authentication to discover bazaar items.
// Option 1: Import the default facilitator config
// Works for list endpoint without credentials, or with CDP_API_KEY_ID and CDP_API_KEY_SECRET environment variables for verify/settle
import { facilitator } from "@coinbase/x402";
// Option 2: Create a facilitator config, passing in credentials directly
import { createFacilitatorConfig } from "@coinbase/x402";
const facilitator = createFacilitatorConfig("your-cdp-api-key-id", "your-cdp-api-key-secret"); // Pass in directly from preferred secret management
// Use the facilitator config in your x402 integration
import express from "express";
import { paymentMiddleware } from "x402-express";
import { facilitator } from "@coinbase/x402";
const app = express();
// Requires CDP_API_KEY_ID and CDP_API_KEY_SECRET environment variables
// for payment verification and settlement
app.use(paymentMiddleware(
"0xYourAddress",
{
"/protected": {
price: "$0.10",
network: "base-sepolia"
}
},
facilitator // Use Coinbase's facilitator
));
FAQs
x402 Payment Protocol
The npm package @coinbase/x402 receives a total of 11,291 weekly downloads. As such, @coinbase/x402 popularity was classified as popular.
We found that @coinbase/x402 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.