@coinbase/x402
4
Versions
—
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
coinbase-ownercoinbase-npm
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Runs a local bundled script (scripts/postinstall.js), not a remote fetch; consistent with Coinbase SDK setup pattern. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): zod is a declared runtime dependency; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:viem | AI (phantom-deps): viem is a declared runtime dependency; phantom-dep heuristic false positive for this package. | ai |