@dynamic-labs-sdk/metamask
Chain-agnostic primitives for integrating the [MetaMask SDK](https://docs.metamask.io/sdk/) (`@metamask/connect-multichain` and its chain-specific facades such as `@metamask/connect-evm`) with the Dynamic JS SDK.
This report shows the evidence for @dynamic-labs-sdk/metamask@1.49.0. 0 of 40 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s MetaMask client dependency enables runtime analytics by default, and the wrapper does not configure an opt-out. The observed events carry usage metadata such as app identity and requested chains, so this is undisclosed runtime telemetry rather than credential exfiltration.
Decision evidence
public snapshot- The package creates the MetaMask multichain client without setting an analytics option.
- The dependency defaults analytics to enabled when no setting is provided.
- On connection, the dependency tracks configured and requested chains and attaches dapp ID, anonymous ID, platform, and version properties.
- The wrapper starts pairing by calling connect when its connection helper is used, so this telemetry is triggered at runtime rather than on import or install.
- The manifest contains no install lifecycle script.
- The reviewed package code does not collect credentials or machine details.
Source & flagged code
5 flaggedThe package creates the MetaMask multichain client without setting an analytics option.
dist/getOrCreateMetaMaskClientInstanceManager-DPH8CjB3.cjsView on unpkg · L579Findings
Affected versions and remediation
This report applies to @dynamic-labs-sdk/metamask@1.49.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @dynamic-labs-sdk/metamask@1.49.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.