The npm package x402-prompt-injection-scan version 0.1.4 is identified as malicious software. Although static and behavioral scans did not detect typical malicious behaviors such as network communication or credential harvesting, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised system is strongly advised.