
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
x402-fetch
Advanced tools
A utility package that extends the native fetch API to automatically handle 402 Payment Required responses using the x402 payment protocol. This package enables seamless integration of payment functionality into your applications when making HTTP requests.
npm install x402-fetch
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { wrapFetchWithPayment } from "x402-fetch";
import { baseSepolia } from "viem/chains";
// Create a wallet client
const account = privateKeyToAccount("0xYourPrivateKey");
const client = createWalletClient({
account,
transport: http(),
chain: baseSepolia,
});
// Wrap the fetch function with payment handling
const fetchWithPay = wrapFetchWithPayment(fetch, client);
// Make a request that may require payment
const response = await fetchWithPay("https://api.example.com/paid-endpoint", {
method: "GET",
});
const data = await response.json();
wrapFetchWithPayment(fetch, walletClient, maxValue?, paymentRequirementsSelector?)Wraps the native fetch API to handle 402 Payment Required responses automatically.
fetch: The fetch function to wrap (typically globalThis.fetch)walletClient: The wallet client used to sign payment messages (must implement the x402 wallet interface)maxValue: Optional maximum allowed payment amount in base units (defaults to 0.1 USDC)paymentRequirementsSelector: Optional function to select payment requirements from the response (defaults to selectPaymentRequirements)A wrapped fetch function that automatically handles 402 responses by:
import { config } from "dotenv";
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { wrapFetchWithPayment } from "x402-fetch";
import { baseSepolia } from "viem/chains";
config();
const { PRIVATE_KEY, API_URL } = process.env;
const account = privateKeyToAccount(PRIVATE_KEY as `0x${string}`);
const client = createWalletClient({
account,
transport: http(),
chain: baseSepolia,
});
const fetchWithPay = wrapFetchWithPayment(fetch, client);
// Make a request to a paid API endpoint
fetchWithPay(API_URL, {
method: "GET",
})
.then(async response => {
const data = await response.json();
console.log(data);
})
.catch(error => {
console.error(error);
});
FAQs
x402 Payment Protocol
The npm package x402-fetch receives a total of 6,237 weekly downloads. As such, x402-fetch popularity was classified as popular.
We found that x402-fetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.