@dynamic-labs-sdk/metamask@1.44.0
⚠ Under reviewChain-agnostic primitives for integrating the [MetaMask SDK](https://docs.metamask.io/sdk/) (`@metamask/connect-multichain` and its chain-specific facades such as `@metamask/connect-evm`) with the Dynamic JS SDK.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected package source shows a user-facing MetaMask pairing flow and no confirmed attack behavior. The directly imported @dynamic-labs/sdk-api-core dependency could not be fully assessed because its source snapshot was truncated, so the package cannot be marked clean.
Decision evidence
public snapshot- The manifest declares @dynamic-labs/sdk-api-core 0.121.0, and the runtime entrypoint imports WalletProviderEnum from it; that dependency’s source was unavailable for verification in this snapshot.
- The connection API starts MetaMask pairing when called, then registers the wallet provider and reads its addresses in the returned approval function after pairing completes.
- The MetaMask client is configured with app metadata, supported networks, and the package’s storage adapter.
- No concrete attack behavior was identified in the inspected package source.
- The visible account and provider actions follow an explicit connection and pairing flow.
Source & flagged code
6 flaggedThe manifest declares @dynamic-labs/sdk-api-core 0.121.0, and the runtime entrypoint imports WalletProviderEnum from it; that dependency’s source was unavailable for verification in this snapshot.
package.jsonView on unpkg · L27The manifest declares @dynamic-labs/sdk-api-core 0.121.0, and the runtime entrypoint imports WalletProviderEnum from it; that dependency’s source was unavailable for verification in this snapshot.
dist/index.esm.jsView on unpkg · L5Findings
Affected versions and remediation
This report applies to @dynamic-labs-sdk/metamask@1.44.0.
See all versions of @dynamic-labs-sdk/metamask for other recorded verdicts.
- Review the evidence and your use of @dynamic-labs-sdk/metamask@1.44.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.