registry / @coinbase/cdp-sdk / 1.57.0
@coinbase/cdp-sdk@1.57.0
SDK for interacting with the Coinbase Developer Platform Wallet API
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected credential flow signs requests for the configured CDP service, and the flagged JWT secret examples are placeholders. Runtime analytics go to Coinbase, are documented with opt-outs, and no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
Client setup and calls to SDK features; usage and error events are sent when those events occur.
Impact
Expected CDP API and RPC access, plus documented usage and error reporting; no hostile behavior was found.
Mechanism
Authenticated RPC lookup uses the configured CDP API base URL. Analytics are sent to cca-lite.coinbase.com; the default API base URL is api.cdp.coinbase.com. The README documents both analytics opt-outs.
AI rationale
The inspected credential flow signs requests for the configured CDP service, and the flagged JWT secret examples are placeholders. Runtime analytics go to Coinbase, are documented with opt-outs, and no malicious behavior was identified.
Network endpoints2
api.cdp.coinbase.comcca-lite.coinbase.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as Coinbase’s CDP Wallet API SDK and points to CommonJS and ESM library entry points.
- The RPC helper signs a GET request for the configured CDP API base URL and uses the response to construct a CDP RPC URL.
- Usage tracking and error reporting go to Coinbase’s analytics endpoint, have environment-variable opt-outs, and are documented in the README.
- The JWT type declarations show placeholder key examples rather than an embedded secret.
Evidence against
- The SDK can read API credentials from environment variables and send authenticated requests to its configured service.
- Runtime analytics are enabled by default; error events include error messages and stack traces.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged_types/auth/utils/jwt.d.tsView file
25patternName = private_key_ec
severity = critical
line = 25
Critical
Critical Secret
Package contains a critical-looking secret pattern.
_types/auth/utils/jwt.d.tsView on unpkg · L2525patternName = private_key_ec
severity = critical
line = 25
Critical
Secret Pattern
EC private key in _types/auth/utils/jwt.d.ts
_types/auth/utils/jwt.d.tsView on unpkg · L25_cjs/x402/account-signers.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
12 Critical1 High2 Medium4 Low
CriticalCritical Secret_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/http.d.ts
CriticalSecret Pattern_types/auth/utils/ws.d.ts
CriticalSecret Pattern_types/auth/hooks/axios/withAuth.d.ts
CriticalSecret Pattern_types/openapi-client/cdpApiClient.d.ts
CriticalSecret Patternsrc/auth/utils/jwt.ts
CriticalSecret Patternsrc/auth/utils/http.ts
CriticalSecret Patternsrc/auth/utils/ws.ts
CriticalSecret Patternsrc/auth/README.md
CriticalSecret Patternsrc/auth/hooks/axios/withAuth.ts
Critical
Affected versions and remediation
This report applies to @coinbase/cdp-sdk@1.57.0.
See all versions of @coinbase/cdp-sdk for other recorded verdicts.
- Review the evidence and your use of @coinbase/cdp-sdk@1.57.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.