
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
EVM (Ethereum Virtual Machine) implementation of the x402 payment protocol using the Exact payment scheme with EIP-3009 TransferWithAuthorization.
npm install @x402/evm
This package provides three main components for handling x402 payments on EVM-compatible blockchains:
@x402/evm)V2 Protocol Support - Modern x402 protocol with CAIP-2 network identifiers
Client:
ExactEvmClient - V2 client implementation using EIP-3009toClientEvmSigner(account) - Converts viem accounts to x402 signersClientEvmSigner - TypeScript type for client signersFacilitator:
ExactEvmFacilitator - V2 facilitator for payment verification and settlementtoFacilitatorEvmSigner(wallet) - Converts viem wallets to facilitator signersFacilitatorEvmSigner - TypeScript type for facilitator signersService:
ExactEvmServer - V2 service for building payment requirements@x402/evm/v1)V1 Protocol Support - Legacy x402 protocol with simple network names
Exports:
ExactEvmClientV1 - V1 client implementationExactEvmFacilitatorV1 - V1 facilitator implementationNETWORKS - Array of all supported V1 network namesSupported V1 Networks:
[
"abstract", "abstract-testnet",
"base-sepolia", "base",
"avalanche-fuji", "avalanche",
"iotex", "sei", "sei-testnet",
"polygon", "polygon-amoy",
"peaq", "story", "educhain",
"skale-base-sepolia"
]
@x402/evm/client)Convenience builder for creating fully-configured EVM clients
Exports:
createEvmClient(config) - Creates x402Client with EVM supportEvmClientConfig - Configuration interfaceWhat it does:
eip155:*)NETWORKSExample:
import { createEvmClient } from "@x402/evm/client";
import { toClientEvmSigner } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";
const account = privateKeyToAccount("0x...");
const signer = toClientEvmSigner(account);
const client = createEvmClient({ signer });
// Ready to use with both V1 and V2!
eip155:8453)eip155:*)base-sepolia)import { createEvmClient } from "@x402/evm/client";
import { wrapFetchWithPayment } from "@x402/fetch";
const client = createEvmClient({ signer: myEvmSigner });
const paidFetch = wrapFetchWithPayment(fetch, client);
import { x402Client } from "@x402/core/client";
import { ExactEvmClient } from "@x402/evm";
import { ExactEvmClientV1 } from "@x402/evm/v1";
const client = new x402Client()
.register("eip155:*", new ExactEvmClient(signer))
.registerSchemeV1("base-sepolia", new ExactEvmClientV1(signer))
.registerSchemeV1("base", new ExactEvmClientV1(signer));
ExactEvmClient only requires signer support for address + signTypedData.
Permit2 extension enrichment (EIP-2612 / ERC-20 approval gas sponsoring) can
optionally use explicit RPC config when signer read/fee helpers are unavailable.
No chain-default RPC fallback is applied by the SDK.
// Per-network explicit registration
const client = new x402Client()
.register("eip155:137", new ExactEvmClient(signer, { rpcUrl: polygonRpcUrl }))
.register("eip155:8453", new ExactEvmClient(signer, { rpcUrl: baseRpcUrl }));
// Wildcard registration with chain-id keyed config map
const wildcardClient = new x402Client().register(
"eip155:*",
new ExactEvmClient(signer, {
137: { rpcUrl: polygonRpcUrl },
8453: { rpcUrl: baseRpcUrl },
}),
);
import { x402Client } from "@x402/core/client";
import { ExactEvmClient } from "@x402/evm";
const client = x402Client.fromConfig({
schemes: [
{ network: "eip155:*", client: new ExactEvmClient(signer) },
{ network: "base-sepolia", client: new ExactEvmClientV1(signer), x402Version: 1 }
],
policies: [myCustomPolicy]
});
V2 Networks (via CAIP-2):
eip155:1 - Ethereum Mainneteip155:8453 - Base Mainneteip155:84532 - Base Sepoliaeip155:* - Wildcard (matches all EVM chains)eip155:<chainId> networkV1 Networks (simple names):
See NETWORKS constant in @x402/evm/v1
Supports two asset transfer methods:
transferWithAuthorization() (e.g., USDC, EURC) — simplest, truly gaslessSee DEFAULT_ASSET.md for the current list of configured chains and how to add new ones.
# Build
npm run build
# Test
npm run test
# Integration tests
npm run test:integration
# Lint & Format
npm run lint
npm run format
@x402/core - Core protocol types and client@x402/fetch - HTTP wrapper with automatic payment handling@x402/svm - Solana/SVM implementation@x402/stellar - Stellar implementationFAQs
x402 Payment Protocol EVM Implementation
The npm package @x402/evm receives a total of 32,253 weekly downloads. As such, @x402/evm popularity was classified as popular.
We found that @x402/evm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.