@dynamic-labs-sdk/metamask@1.43.1
⚠ Under reviewChain-agnostic primitives for integrating the [MetaMask SDK](https://docs.metamask.io/sdk/) (`@metamask/connect-multichain` and its chain-specific facades such as `@metamask/connect-evm`) with the Dynamic JS SDK.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package manifest has no install lifecycle hook, and the inspected entrypoint shows no concrete attack behavior. The pinned API core dependency is selected and imported at runtime, but its unavailable source prevents a clean verdict.
Decision evidence
public snapshot- package.json defines build, lint, and test scripts, with no preinstall, install, or postinstall hook.
- The manifest pins @dynamic-labs/sdk-api-core to version 0.117.0.
- The CommonJS entrypoint imports @dynamic-labs/sdk-api-core at runtime.
- The inspected MetaMask dependency configures a WebSocket transport using its relay URL and storage adapter.
- The pinned API core dependency is imported at runtime, but its source archive was unavailable in the package snapshot, leaving its behavior unassessed.
Source & flagged code
4 flaggedpackage.json defines build, lint, and test scripts, with no preinstall, install, or postinstall hook.
package.jsonView on unpkg · L48The manifest pins @dynamic-labs/sdk-api-core to version 0.117.0.
package.jsonView on unpkg · L26Findings
Affected versions and remediation
This report applies to @dynamic-labs-sdk/metamask@1.43.1.
See all versions of @dynamic-labs-sdk/metamask for other recorded verdicts.
- Review the evidence and your use of @dynamic-labs-sdk/metamask@1.43.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.