registry / @coinbase/cdp-sdk / 1.54.0
@coinbase/cdp-sdk@1.54.0
SDK for interacting with the Coinbase Developer Platform Wallet API
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner's secret finding is a false positive: jwt.ts consumes caller-provided private keys only to create short-lived JWTs. Source inspection found normal Coinbase SDK networking and telemetry, not a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Constructing CdpClient or explicitly invoking SDK API/x402 methods.
Impact
Performs requested Coinbase platform operations; no unconsented malicious behavior established.
Mechanism
CDP API authentication, requests, and optional usage/error telemetry.
AI rationale
The scanner's secret finding is a false positive: jwt.ts consumes caller-provided private keys only to create short-lived JWTs. Source inspection found normal Coinbase SDK networking and telemetry, not a concrete malicious chain.
Evidence
package.jsonsrc/client/cdp.tssrc/openapi-client/cdpApiClient.tssrc/auth/utils/jwt.tssrc/analytics.tssrc/x402/server.tssrc/auth/hooks/axios/withAuth.ts
Network endpoints3
api.cdp.coinbase.com/platformcca-lite.coinbase.com/ampapi.cdp.coinbase.com/platform/v2/x402
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No lifecycle install hooks in package.json.
- No child-process, eval/vm, agent-control, or filesystem-write usage found.
- JWT code signs caller-provided credentials locally.
Evidence against
- src/client/cdp.ts reads only named CDP environment variables when a client is constructed.
- src/openapi-client/cdpApiClient.ts targets the Coinbase CDP API by default.
- src/analytics.ts posts action/error telemetry to a Coinbase endpoint and provides environment-variable opt-outs.
- src/x402/server.ts reads only the caller-supplied configPath.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged_cjs/auth/utils/jwt.jsView file
94patternName = private_key_rsa
severity = critical
line = 94
matchedText = const pe...ffer
Critical
Critical Secret
Package contains a critical-looking secret pattern.
_cjs/auth/utils/jwt.jsView on unpkg · L9494patternName = private_key_rsa
severity = critical
line = 94
matchedText = const pe...ffer
Critical
_types/auth/utils/jwt.d.tsView file
25patternName = private_key_ec
severity = critical
line = 25
matchedText = * '----...56))
Critical
Secret Pattern
EC private key in _types/auth/utils/jwt.d.ts
_types/auth/utils/jwt.d.tsView on unpkg · L25Findings
15 Critical2 Medium4 Low
CriticalCritical Secret_cjs/auth/utils/jwt.js
CriticalSecret Pattern_cjs/auth/utils/jwt.js
CriticalSecret Pattern_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/http.d.ts
CriticalSecret Pattern_types/auth/utils/ws.d.ts
CriticalSecret Pattern_types/auth/hooks/axios/withAuth.d.ts
CriticalSecret Pattern_types/openapi-client/cdpApiClient.d.ts
CriticalSecret Pattern_esm/auth/utils/jwt.js
CriticalSecret Patternsrc/auth/utils/jwt.ts
CriticalSecret Patternsrc/auth/utils/jwt.ts
CriticalSecret Patternsrc/auth/utils/http.ts
CriticalSecret Patternsrc/auth/utils/ws.ts
Affected versions and remediation
This report applies to @coinbase/cdp-sdk@1.54.0.
See all versions of @coinbase/cdp-sdk for other recorded verdicts.
- Review the evidence and your use of @coinbase/cdp-sdk@1.54.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.