@coinbase/cdp-sdk@1.57.1
SDK for interacting with the Coinbase Developer Platform Wallet API
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged JWT flow uses configured credentials for a request to the configured CDP API host, and the runtime analytics are sent to Coinbase with documented opt-outs. The package has no install lifecycle hooks in its manifest, and the reviewed flagged files show SDK functionality rather than malicious behavior.
Decision evidence
public snapshot- The manifest identifies this as Coinbase's CDP Wallet API SDK and declares no install lifecycle scripts.
- The EVM helper signs a JWT for an API request using the configured CDP credentials.
- The CDP client defaults to https://api.cdp.coinbase.com/platform, and permits an explicitly configured basePath.
- The SDK documents its runtime error reporting and usage tracking and provides environment-variable opt-outs.
- Analytics events are sent to Coinbase's cca-lite.coinbase.com endpoint.
Source & flagged code
13 flaggedPackage contains a critical-looking secret pattern.
_types/auth/utils/jwt.d.tsView on unpkg · L25EC private key in _types/auth/utils/jwt.d.ts
_types/auth/utils/jwt.d.tsView on unpkg · L25A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
Affected versions and remediation
This report applies to @coinbase/cdp-sdk@1.57.1.
See all versions of @coinbase/cdp-sdk for other recorded verdicts.
- Review the evidence and your use of @coinbase/cdp-sdk@1.57.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.