
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
CLI for Xenarch — non-custodial x402 MCP server for AI agents. Claude, Cursor, LangChain and CrewAI pay HTTP 402–gated APIs with USDC on Base L2.
Xenarch is a non-custodial x402 MCP server. Claude, Cursor and any MCP client pay for HTTP 402–gated content with USDC micropayments on Base L2. Direct agent-to-publisher settlement. 0% fee, no contract, facilitator-agnostic.
This package is the xenarch command-line tool. Use it from a terminal to manage an agent wallet, pay x402-gated URLs by hand, and (for publishers) register sites and check stats against the Xenarch API.
Agent commands:
xenarch wallet — create / inspect / export the local agent walletxenarch check <url> — probe a URL for an x402 challenge without payingxenarch pay <url> — pay an x402-gated URL with USDC on Base L2 and fetch the contentxenarch history — list past payments made from this walletPublisher commands:
xenarch login / xenarch register — authenticate with the Xenarch APIxenarch site-add / xenarch sites — register and list publisher sitesxenarch stats — view per-site payment statsxenarch payout — manage payout settingsGlobal flags: --json for machine-readable output, --api-base to override the API URL, --rpc-url to override the Base RPC endpoint.
npm install -g xenarch
Requires Node.js 18 or later.
# Create an agent wallet (stored locally)
xenarch wallet create
# See what an x402-gated URL would charge
xenarch check https://example.com/premium-article
# Pay and fetch in one step
xenarch pay https://example.com/premium-article
# List your payment history
xenarch history --json
Set XENARCH_PRIVATE_KEY to use an existing wallet instead of the local one, and XENARCH_MAX_PAYMENT_USD to cap per-call spend (default unbounded).
@xenarch/agent-mcpLearn more: https://xenarch.com
FAQs
CLI for Xenarch — non-custodial x402 MCP server for AI agents. Claude, Cursor, LangChain and CrewAI pay HTTP 402–gated APIs with USDC on Base L2.
The npm package xenarch receives a total of 255 weekly downloads. As such, xenarch popularity was classified as not popular.
We found that xenarch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.