
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
peer-cash-mcp
Advanced tools
An MCP server for agents that need to cash out Base USDC through Peer Cash. It exposes live payout capabilities, oracle estimates, unsigned transaction preparation, receipt finalization, order reads, withdrawals, and top-ups.
The server never accepts private keys or submits transactions. Write tools return unsigned Base transactions for the host wallet to review, approve, sign, and confirm.
The repository is also an Agent Plugins 1.0 package. plugin.json identifies the package, skills/peer-cash/SKILL.md provides the portable workflow, and mcp.json starts the published server without embedding credentials.
{
"mcpServers": {
"peer-cash": {
"command": "npx",
"args": ["-y", "peer-cash-mcp"]
}
}
}
The default environment is production and the public Base RPC is sufficient for normal reads. Optional environment variables:
| Variable | Purpose |
|---|---|
PEER_CASH_ENVIRONMENT | production, preproduction, or staging |
PEER_CASH_RPC_URL | Custom Base RPC for reads and receipt finalization |
PEER_CASH_API_KEY | Curator API key when the selected environment requires one |
PEER_CASH_REFERRAL_CODE | Six-character Peer integration referral code |
PEER_CASH_REFERRER | Analytics-only ERC-8021 attribution code |
peer_cash_capabilities before naming a payout platform or currency.peer_cash_estimate. Treat it as approximate: the binding Chainlink rate resolves when a buyer fills.peer_cash_prepare with a Base USDC amount in 6-decimal base units and one or more payout legs.peer_cash_finalize with the confirmed createDeposit transaction hash.accessPolicyRequired was true, call peer_cash_prepare_access_policy and submit that transaction with the depositor wallet.depositId for order tracking and recovery.Unknown transaction outcomes must be inspected before any resubmission. Peer Cash errors include a code, retryability, remediation, and recovery evidence for this purpose.
bun install
bun run ci
Requires Node.js 22 or newer.
Validate the portable package separately from the server test suite:
npx skills-ref validate skills/peer-cash
FAQs
MCP server for preparing and tracking Peer Cash Base USDC cash-outs
We found that peer-cash-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.