
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@true402.dev/ai-sdk
Advanced tools
true402 tools for the Vercel AI SDK — pay-per-call on-chain rug/honeypot & address safety for Base AI agents over x402 (USDC, no account, no API key).
Stable · production-ready — semver-stable public API (v1.0).
true402 tools for the Vercel AI SDK — give your Base agent pay-per-call on-chain safety over x402: rug/honeypot checks, address safety, and deployer reputation. No account, no API key — the wallet is the identity (USDC on Base, gas sponsored by the facilitator).
npm i @true402.dev/ai-sdk ai
import { generateText } from 'ai';
import { true402Tools } from '@true402.dev/ai-sdk';
const { text } = await generateText({
model,
prompt: 'Is 0x4ed4…Efed safe to ape into?',
tools: true402Tools({ payerPrivateKey: process.env.PAYER_PRIVATE_KEY! }),
});
The model can call, before it trades:
| Tool | What it does | ~price |
|---|---|---|
true402_token_report | Composite avoid / caution / ok verdict for a Base ERC-20 (buy/sell honeypot sim + liquidity + ownership + rug activity) | $0.01 |
true402_token_safety | Structural safety score 0–100 + flags | $0.005 |
true402_address_safety | Profile + risk for any address before you send/approve/call it (proxy detection) | $0.005 |
true402_deployer_check | Deployer reputation — who made the token + their track record | $0.008 |
payerPrivateKey is a Base wallet holding a little USDC. Without it the stalls still return their HTTP 402 price, so the agent can decide. Override baseUrl / rpcUrl in the options if self-hosting.
Checking tokens by hand? Send any Base token address to @True402bot on Telegram — same on-chain checks, free, no wallet.
Powered by true402 — the machine-native x402 marketplace on Base. Browse every stall at /catalog.
FAQs
true402 tools for the Vercel AI SDK — pay-per-call on-chain rug/honeypot & address safety, plus search/SEO data (backlinks, keyword volume, rankings), for AI agents over x402 (USDC, no account, no API key).
The npm package @true402.dev/ai-sdk receives a total of 40 weekly downloads. As such, @true402.dev/ai-sdk popularity was classified as not popular.
We found that @true402.dev/ai-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.