w3bs.AccountStart building
PACKAGES / Profullstack

coinpay

SDK and CLI for accepting crypto and card payments, with wallet and swap commands.

ThreatCrush · No malware found
INSTALLw3bs install coinpayportal.com/coinpay

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install coinpayportal.com/coinpayInstall coinpay and track it for updates
  2. coinpay loginSign in with OAuth in your browser (--device on a headless box)
  3. coinpay payment create --business-id <business-id> --amount <amount> --blockchain <chain>Create a crypto payment request and print its address
  4. coinpay payment get <payment-id>Show a payment's details and status
  5. coinpay payment list --business-id <business-id>List payments for one of your businesses

Every option: coinpay --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in coinpay 1.0.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 20:22 UTC · threatcrush 0.13.30
Files
2370 (installer + github.com/profullstack/coinpayportal@2bcf58565f66)
Findings
1 critical · 12 high · 29 medium · 61 low
100+ other findings (not malware)
  • critical
    Private Keysource/.env.example:255secret-private-key · CWE-798
  • high
    network output piped into a shellinstaller/install.sh:405sh-remote-script-execution · CWE-494
  • high
    Generic API Keysource/docs/API.md:430secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/docs/API.md:589secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/docs/sdk/getting-started.md:36secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/docs/sdk/getting-started.md:318secret-generic-api-key · CWE-798
  • high
    Hardcoded Credentialsource/packages/extension/scripts/make-screenshots.mjs:283secret-generic-credential · CWE-798
  • high
    Generic API Keysource/packages/sdk/README.md:99secret-generic-api-key · CWE-798
  • high
    network output piped into a shellsource/public/install.sh:405sh-remote-script-execution · CWE-494
  • high
    Generic API Keysource/src/app/docs/sdk/page.tsx:135secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/src/app/docs/sdk/page.tsx:214secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/src/app/docs/sdk/page.tsx:1401secret-generic-api-key · CWE-798
  • high
    Generic API Keysource/src/app/docs/sdk/page.tsx:1533secret-generic-api-key · CWE-798
  • medium
    network output piped into a shellinstaller/install.sh:153sh-remote-script-execution · CWE-494
  • medium
    unquoted expansion in a destructive commandinstaller/install.sh:713sh-unquoted-expansion-destructive · CWE-78
  • medium
    network output piped into a shellinstaller/install.sh:816sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellinstaller/install.sh:817sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellinstaller/install.sh:818sh-remote-script-execution · CWE-494
  • medium
    dynamic code executionsource/packages/extension/scripts/make-screenshots.mjs:256js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/packages/extension/scripts/make-screenshots.mjs:265js-dynamic-code-execution · CWE-95
  • medium
    network output piped into a shellsource/public/install.sh:153sh-remote-script-execution · CWE-494
  • medium
    unquoted expansion in a destructive commandsource/public/install.sh:713sh-unquoted-expansion-destructive · CWE-78
  • medium
    network output piped into a shellsource/public/install.sh:816sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/public/install.sh:817sh-remote-script-execution · CWE-494
  • medium
    network output piped into a shellsource/public/install.sh:818sh-remote-script-execution · CWE-494
  • medium
    unescaped HTML renderingsource/public/payments.js:93js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/public/payments.js:139js-unescaped-html-sink · CWE-79
  • medium
    static initialization vectorsource/scripts/decrypt-wallet-backup.mjs:31js-predictable-cipher-iv · CWE-329
  • medium
    unescaped HTML renderingsource/src/app/blog/[slug]/page.tsx:133js-unescaped-html-sink · CWE-79
  • medium
    redirect to a non-constant destinationsource/src/app/invoices/[id]/pay/page.tsx:164js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/src/app/layout.tsx:114js-unescaped-html-sink · CWE-79
  • medium
    redirect to a non-constant destinationsource/src/app/login/page.tsx:28js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/app/login/page.tsx:32js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/app/login/page.tsx:145js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/app/oauth/consent/page.tsx:87js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/components/business/PayPalConnectTab.tsx:169js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/components/business/StripeConnectTab.tsx:142js-open-redirect · CWE-601
  • medium
    redirect to a non-constant destinationsource/src/components/business/StripeTab.tsx:178js-open-redirect · CWE-601
  • medium
    unescaped HTML renderingsource/src/components/PitFooter.tsx:25js-unescaped-html-sink · CWE-79
  • medium
    JWT decoded without verifying the signaturesource/src/lib/auth/jwt.ts:88js-jwt-decode-without-verify · CWE-347
  • medium
    regex with nested unbounded quantifierssource/src/lib/auth/spam-detection.ts:45redos-nested-quantifier · CWE-1333
  • medium
    static initialization vectorsource/src/lib/crypto/encryption.ts:103js-predictable-cipher-iv · CWE-329
  • low
    Hardcoded Credentialsource/docs/FIX_VERIFY_SIGNATURE.md:156secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/docs/integration-examples/nodejs-bot.md:225secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/sdk/README.md:122secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/sdk/README.md:874secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/sdk/test/business-create.test.js:56secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/sdk/test/escrow.test.js:188secret-generic-credential · CWE-798
  • low
    dynamic code executionsource/packages/sdk/test/tax-sources.test.js:107js-dynamic-code-execution · CWE-95
  • low
    dynamic code executionsource/packages/sdk/test/tax-sources.test.js:110js-dynamic-code-execution · CWE-95
  • low
    regular expression compiled from a variablesource/src/app/api/oauth/authorize/route.test.ts:52js-regex-from-input · CWE-1333
  • low
    unescaped HTML renderingsource/src/app/docs/prompts/[slug]/page.tsx:37js-unescaped-html-sink · CWE-79
  • low
    Hardcoded Credentialsource/src/app/docs/sdk/page.tsx:1001secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/app/docs/sdk/page.tsx:1022secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/app/docs/sdk/page.tsx:1482secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/app/docs/sdk/page.tsx:1491secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/components/docs/AuthenticationDocs.tsx:37secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/components/docs/OAuthDocs.tsx:281secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/src/components/lightning/__tests__/LightningSetup.test.tsx:58secret-hex-token · CWE-798
  • low
    JSON Web Tokensource/src/lib/auth/apikey.test.ts:308secret-jwt · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/auth/apikey.test.ts:308secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/auth/jwt.test.ts:136secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/auth/jwt.test.ts:183secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/crypto/encryption.test.ts:212secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/crypto/encryption.test.ts:220secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:108secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:402secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:418secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:419secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:435secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:436secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:598secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:599secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/escrow/service.test.ts:730secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/multisig/adapters/evm-safe.test.ts:187secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/multisig/engine.test.ts:279secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/multisig/engine.test.ts:280secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/multisig/engine.test.ts:281secret-hex-token · CWE-798
  • low
    Generic API Keysource/src/lib/proposals/notify.test.ts:20secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/proposals/notify.test.ts:20secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/wallet-sdk/__tests__/sdk-integration.test.ts:695secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/wallet-sdk/backup-wallet.test.ts:39secret-hex-token · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/wallet-sdk/backup-wallet.test.ts:58secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/wallet-sdk/backup.test.ts:7secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/wallet-sdk/backup.test.ts:65secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/__tests__/send-transaction-flow.test.ts:236secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/__tests__/send-transaction-flow.test.ts:409secret-hex-token · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/web-wallet/client-crypto.test.ts:23secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/identity.test.ts:19secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/identity.test.ts:24secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/identity.test.ts:27secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/identity.test.ts:64secret-hex-token · CWE-798
  • low
    Hardcoded Credentialsource/src/lib/web-wallet/seedphrase-backup.test.ts:61secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/signing.test.ts:195secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/signing.test.ts:268secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/signing.test.ts:335secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/signing.test.ts:346secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/signing.test.ts:347secret-hex-token · CWE-798
  • low
    High-entropy Hex Tokensource/src/lib/web-wallet/signing.test.ts:376secret-hex-token · CWE-798
  • low
    predictable randomness used for a security valuesource/src/lib/web-wallet/wallet-registry.test.ts:25insecure-randomness-for-secret · CWE-338

Showing the first 100 findings.

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/coinpayportal.com/coinpay/badge.svg)](https://w3bs.org/packages/coinpayportal.com/coinpay)