@dogeos/dogeos-sdk@4.0.6
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe credential-exfiltration scanner finding is not supported by the inspected source: matching credentials are used in wallet and DogeOS authentication flows. However, default runtime telemetry sends app-domain and event metadata to WalletConnect, and the README does not disclose it, so this merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
WalletConnect core initialization or event submission in an application using the SDK.
Impact
WalletConnect receives app-domain and event metadata; this is an undisclosed runtime telemetry concern, not evidence of credential theft.
Mechanism
The bundled event client defaults telemetry to enabled, records app domain and client metadata, and posts events with the project ID to the WalletConnect pulse endpoint.
AI rationale
The credential-exfiltration scanner finding is not supported by the inspected source: matching credentials are used in wallet and DogeOS authentication flows. However, default runtime telemetry sends app-domain and event metadata to WalletConnect, and the README does not disclose it, so this merits a warning.
Evidence
dist/index.js
Network endpoints1
pulse.walletconnect.org/batch
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled WalletConnect event client enables telemetry by default unless `telemetryEnabled` is set to false.
- The client sends events to `https://pulse.walletconnect.org/batch`, including the app domain, project ID, random client ID, and user agent.
- The manifest has no lifecycle scripts; its entry point is a wallet SDK bundle.
Evidence against
- Credential matches in the bundle are used in DogeOS authentication flows or wallet cryptography; no automatic forwarding of unrelated credentials was identified.
- The package README describes a wallet connection SDK that uses a public project client ID.
Behavioral surface
CryptoEvalNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
22import "@aptos-labs/ts-sdk";
L23: import { PublicKey as Pn, VersionedTransaction as aE, Transaction as cE } from "@solana/web3.js";
L24: import { HeroUIProvider as lE, Input as qg, NumberInput as fE, DateInput as uE, Textarea as dE, TimeInput as hE, InputOtp as pE, heroui as gE, Button as qt, Image as Ws, Spinner as...
...
L204: for (let i = 0, s = 0; i < r; i++, s += 2) {
L205: const o = Im(e.charCodeAt(s)), a = Im(e.charCodeAt(s + 1));
L206: if (o === void 0 || a === void 0) {
...
L656: const n = JSON.stringify({
L657: data: t,
L658: time: (/* @__PURE__ */ new Date()).getTime(),
...
L770: fill: "none",
L771: xmlns: "http://www.w3.org/2000/svg",
L772: style: {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L2222Trigger-reachable chain: manifest.main -> dist/index.js
L22: import "@aptos-labs/ts-sdk";
L23: import { PublicKey as Pn, VersionedTransaction as aE, Transaction as cE } from "@solana/web3.js";
L24: import { HeroUIProvider as lE, Input as qg, NumberInput as fE, DateInput as uE, Textarea as dE, TimeInput as hE, InputOtp as pE, heroui as gE, Button as qt, Image as Ws, Spinner as...
...
L204: for (let i = 0, s = 0; i < r; i++, s += 2) {
L205: const o = Im(e.charCodeAt(s)), a = Im(e.charCodeAt(s + 1));
L206: if (o === void 0 || a === void 0) {
...
L656: const n = JSON.stringify({
L657: data: t,
L658: time: (/* @__PURE__ */ new Date()).getTime(),
...
L770: fill: "none",
L771: xmlns: "http://www.w3.org/2000/svg",
L772: style: {
Critical
Trigger Reachable Dangerous Capability
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/dogeos-sdk.css
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @dogeos/dogeos-sdk@4.0.6.
See all versions of @dogeos/dogeos-sdk for other recorded verdicts.
- Review the evidence and your use of @dogeos/dogeos-sdk@4.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.