
Security News
Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.
@payai/x402-fetch-starter
Advanced tools
Starter for running an x402 fetch client.
You can find the upstream example at coinbase/x402 → examples/typescript/clients/fetch.
Use your preferred package manager to scaffold:
npm exec @payai/x402-fetch-starter -- my-x402-app
pnpm dlx @payai/x402-fetch-starter my-x402-app
bunx @payai/x402-fetch-starter my-x402-app
Then inside your new app:
npm run dev
When you run the generated app, index.ts will:
.env (for example: RESOURCE_SERVER_URL, ENDPOINT_PATH, PRIVATE_KEY).fetch with x402 using wrapFetchWithPayment.${RESOURCE_SERVER_URL}${ENDPOINT_PATH}.x-payment-response headers (useful for inspecting payment receipts/metadata)Below are notes on the starter itself, which creates the example that devs use to get started.
.github/workflows/sync.ymlcoinbase/x402 and restrict to examples/typescript/clients/fetch.x402-fetch version from npm (best-effort).vendor/upstream/ (transient; ignored in git and cleaned up).scripts/sanitize.sh to:
vendor/upstream/ into template/ (root of the template), preserving structure.template/src/ directory.NOTICE with the upstream commit and clean up vendor/ and upstream/ directories.x402-fetch version into template/package.json (replacing any workspace reference).peter-evans/create-pull-request.Notes:
npm view x402-fetch version fails, the workflow falls back to 0.0.0 and will skip injecting the dependency until it is available.src/ in the template). Your generated app runs from its root.# run the sanitize/mapping script locally (after an upstream sync or manual vendor update)
scripts/sanitize.sh examples/typescript/clients/fetch <commit-sha>
Key files:
template/ – shipped starter template; mirrors upstream example at rootvendor/upstream/ – transient mirror used during sync (gitignored and cleaned).github/workflows/sync.yml – sync/PR workflowscripts/sanitize.sh – maps upstream example into template/ (root)bin/create.js – CLI that scaffolds a new project from template/Release workflow publishes on pushes to main.NPM_TOKEN secret configured in the repo.Apache-2.0. Portions are derived from coinbase/x402 (see NOTICE, LICENSE, and upstream notices).
FAQs
Create an x402 Fetch client in less than 2 minutes!
We found that @payai/x402-fetch-starter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.

Research
/Security News
Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.