registry / @coinbase/cdp-sdk / 1.55.0
@coinbase/cdp-sdk@1.55.0
SDK for interacting with the Coinbase Developer Platform Wallet API
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged_types/auth/utils/jwt.d.tsView file
25patternName = private_key_ec
severity = critical
line = 25
matchedText = * '----...56))
Critical
Critical Secret
Package contains a critical-looking secret pattern.
_types/auth/utils/jwt.d.tsView on unpkg · L2525patternName = private_key_ec
severity = critical
line = 25
matchedText = * '----...56))
Critical
Secret Pattern
EC private key in _types/auth/utils/jwt.d.ts
_types/auth/utils/jwt.d.tsView on unpkg · L25_types/auth/utils/http.d.tsView file
23patternName = private_key_ec
severity = critical
line = 23
matchedText = * '----...56))
Critical
Secret Pattern
EC private key in _types/auth/utils/http.d.ts
_types/auth/utils/http.d.tsFindings
12 Critical2 Medium4 Low
CriticalCritical Secret_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/http.d.ts
CriticalSecret Pattern_types/auth/utils/ws.d.ts
CriticalSecret Pattern_types/auth/hooks/axios/withAuth.d.ts
CriticalSecret Pattern_types/openapi-client/cdpApiClient.d.ts
CriticalSecret Patternsrc/auth/utils/jwt.ts
CriticalSecret Patternsrc/auth/utils/http.ts
CriticalSecret Patternsrc/auth/utils/ws.ts
CriticalSecret Patternsrc/auth/README.md
CriticalSecret Patternsrc/auth/hooks/axios/withAuth.ts
CriticalSecret Pattern
Affected versions and remediation
This report applies to @coinbase/cdp-sdk@1.55.0.
See all versions of @coinbase/cdp-sdk for other recorded verdicts.
- Review the evidence and your use of @coinbase/cdp-sdk@1.55.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.