x402-middleware

Our take

Flagged on multiple independent grounds: ~1,712 weekly downloads on a package four days old with zero stars, zero watchers, and a single commit-account whose login literally ends in '-bot' (created August 2025, 80 repos, zero followers); a README stuffed with fabricated stats ('989 downloads/week', '408 agents on our network', '127K+ marketplace presence'); and an architecture that is openly a toll booth — the code hardcodes the operator's merchant wallet and routes every wrapped MCP payment through swarm.gadgethumans.com for a 0.5% cut, while a postinstall script silently writes an affiliate ID to ~/.gadgethumans so installations earn '19.8% of our commission' MLM-style. Add a live Stripe checkout link for $5-15/month 'premium plans' and a 'store' hosted on a bare IP address (http://167.88.167.30:8899), and the picture is a payment-interception scheme dressed as middleware, not an SDK. Do not install this, and do not route agent funds through it.

reviewed by hand · 2026-07-05

Something wrong or dead here? Report it

Verification record

last verified

3 days ago

npm

@gadgethumans/x402

downloads / wk

119

latest version

4.2.2

in registry since

2026-07-02

github.com/scotia1973-bot/gadgethumans-x402