@coinbase/cdp-sdk@1.60.0
SDK for interacting with the Coinbase Developer Platform Wallet API
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged secret is placeholder documentation, and the highlighted account-signing code is a callable adapter. Runtime analytics and error reporting are disclosed, have opt-outs, and target Coinbase services; no unrelated credential collection or harmful automatic action was found.
Decision evidence
public snapshot- The manifest identifies this as Coinbase’s CDP Wallet API SDK and points to normal CommonJS and ESM entry points.
- The RPC helper returns without credentials and uses the configured CDP base path for its authenticated request.
- Usage tracking sends events to Coinbase’s own analytics endpoint; the README discloses it and documents an opt-out.
- Error reporting is also disclosed in the README and can be disabled with an environment variable.
- The flagged JWT declaration contains placeholder key examples, not an embedded credential.
Source & flagged code
13 flaggedPackage contains a critical-looking secret pattern.
_types/auth/utils/jwt.d.tsView on unpkg · L25EC private key in _types/auth/utils/jwt.d.ts
_types/auth/utils/jwt.d.tsView on unpkg · L25A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
Affected versions and remediation
This report applies to @coinbase/cdp-sdk@1.60.0.
See all versions of @coinbase/cdp-sdk for other recorded verdicts.
- Review the evidence and your use of @coinbase/cdp-sdk@1.60.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.