
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
SVM (Solana Virtual Machine) implementation of the x402 payment protocol using the Exact payment scheme with SPL Token transfers.
npm install @x402/svm
This package provides three main components for handling x402 payments on Solana:
@x402/svm)V2 Protocol Support - Modern x402 protocol with CAIP-2 network identifiers
Client:
ExactSvmClient - V2 client implementation using SPL TokentoClientSvmSigner(keypair) - Converts Solana keypairs to x402 signersClientSvmSigner - TypeScript type for client signersClientSvmConfig - Optional RPC configurationFacilitator:
ExactSvmFacilitator - V2 facilitator for payment verification and settlementtoFacilitatorSvmSigner(keypair) - Converts Solana keypairs to facilitator signersFacilitatorSvmSigner - TypeScript type for facilitator signersFacilitatorRpcClient - RPC client interfaceService:
ExactEvmServer - V2 service for building payment requirementsUtilities:
@x402/svm/v1)V1 Protocol Support - Legacy x402 protocol with simple network names
Exports:
ExactSvmClientV1 - V1 client implementationExactSvmFacilitatorV1 - V1 facilitator implementationNETWORKS - Array of all supported V1 network namesSupported V1 Networks:
[
"solana", // Mainnet
"solana-devnet", // Devnet
"solana-testnet" // Testnet
]
@x402/svm/client)Convenience builder for creating fully-configured SVM clients
Exports:
createSvmClient(config) - Creates x402Client with SVM supportSvmClientConfig - Configuration interfaceWhat it does:
solana:*)NETWORKSExample:
import { createSvmClient } from "@x402/svm/client";
import { toClientSvmSigner } from "@x402/svm";
import { createKeyPairSignerFromBytes } from "@solana/kit";
import { base58 } from "@scure/base";
const keypair = await createKeyPairSignerFromBytes(
base58.decode(process.env.SVM_PRIVATE_KEY)
);
const signer = toClientSvmSigner(keypair);
const client = createSvmClient({ signer });
// Ready to use with both V1 and V2!
solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp)solana:*)solana-devnet)import { createSvmClient } from "@x402/svm/client";
import { wrapFetchWithPayment } from "@x402/fetch";
const client = createSvmClient({ signer: mySvmSigner });
const paidFetch = wrapFetchWithPayment(fetch, client);
import { x402Client } from "@x402/core/client";
import { ExactSvmClient } from "@x402/svm";
import { ExactSvmClientV1 } from "@x402/svm/v1";
const client = new x402Client()
.register("solana:*", new ExactSvmClient(signer))
.registerSchemeV1("solana-devnet", new ExactSvmClientV1(signer))
.registerSchemeV1("solana", new ExactSvmClientV1(signer));
import { x402Client } from "@x402/core/client";
import { ExactSvmClient } from "@x402/svm";
const client = x402Client.fromConfig({
schemes: [
{ network: "solana:*", client: new ExactSvmClient(signer) },
{
network: "solana-devnet",
client: new ExactSvmClientV1(signer),
x402Version: 1
}
]
});
V2 Networks (via CAIP-2):
solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp - Mainnet Betasolana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1 - Devnetsolana:4uhcVJyU9pJkvQyS88uRDiswHXSCkY3z - Testnetsolana:* - Wildcard (matches all Solana networks)V1 Networks (simple names):
solana - Mainnetsolana-devnet - Devnetsolana-testnet - TestnetSupports SPL Token and Token-2022 program tokens:
The exact payment scheme uses SPL Token TransferChecked instruction with:
This package includes a built-in SettlementCache that prevents a known race condition on Solana where the same payment transaction could be settled multiple times before on-chain confirmation. When the facilitator scheme is registered via registerExactSvmScheme, a single SettlementCache instance is automatically shared across both V1 and V2 scheme versions.
The cache rejects concurrent /settle calls that carry the same transaction payload, returning a duplicate_settlement error for the second and subsequent attempts. Entries are automatically evicted after 120 seconds (approximately twice the Solana blockhash lifetime).
No additional configuration is required — duplicate settlement protection is enabled by default when using the standard registration helpers.
For full details on the race condition and mitigation strategy, see the Exact SVM Scheme Specification.
# Build
pnpm build
# Test
pnpm test
# Integration tests
pnpm test:integration
# Lint & Format
pnpm lint
pnpm format
@x402/core - Core protocol types and client@x402/fetch - HTTP wrapper with automatic payment handling@x402/evm - EVM/Ethereum implementation@x402/stellar - Stellar implementation@solana/web3.js - Solana JavaScript SDK (peer dependency)FAQs
x402 Payment Protocol SVM Implementation
We found that @x402/svm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.