registry / @dynamic-labs-sdk/metamask / 1.46.0
@dynamic-labs-sdk/metamask@1.46.0
Chain-agnostic primitives for integrating the [MetaMask SDK](https://docs.metamask.io/sdk/) (`@metamask/connect-multichain` and its chain-specific facades such as `@metamask/connect-evm`) with the Dynamic JS SDK.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected runtime performs a user-approved MetaMask connection flow. The source review found no concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the package and invokes its MetaMask connection API.
Impact
The inspected behavior supports an approved wallet connection; no malicious effect was established.
Mechanism
The package creates a MetaMask multichain client, requests a pairing URI, and registers the wallet provider after connection approval.
AI rationale
The manifest has no install hook, and the inspected runtime performs a user-approved MetaMask connection flow. The source review found no concrete malicious behavior.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes compiled module entrypoints and has no install lifecycle hook.
- The connect flow requests a MetaMask pairing URI and waits for connection approval before registering the wallet provider.
- The package constructs the MetaMask client with configured app details, supported networks, storage, and headless UI settings.
- The SDK API dependency identifies itself as Dynamic Labs API SDK source, while the inspected MetaMask dependencies expose client and protocol code without install hooks.
- The SDK API module defines a wallet-account POST endpoint, and the listed model modules define JSON mappings or enum values for SDK payloads.
- The requested model modules define API data types through JSON conversion helpers and string enum declarations.
- The five model files define JSON conversion functions or enum values for raw-sign, typed-data, and transaction operation payloads.
- The Node ES, browser ES, React Native ES, and Node CommonJS builds emit a display_uri event with a URI or deeplink during connection handling.
Evidence against
Behavioral surface
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@dynamic-labs-sdk/metamask",
"version": "1.46.0",
"type": "module",
"main": "./dist/index.cjs",
"module": "./dist/index.esm.js",
"types": "./dist/exports/index.d.ts",
"files": [
"dist"
],
Low
Suspicious Lifecycle Evidence
package.json exposes compiled module entrypoints and has no install lifecycle hook.
package.jsonView on unpkg · L1.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/0/npm-linux/package.jsonView file
1{
"name": "@dynamic-labs/sdk-api-core",
"version": "0.125.0",
"author": "Dynamic Labs",
"license": "Apache-2.0",
"publishConfig": {
"registry": "https://registry.npmjs.org"
},
"description": "API SDK for app.dynamic.xyz",
"homepage": "https://dynamic.xyz",
"main": "./src/index.
Low
Suspicious Lifecycle Evidence
The SDK API dependency identifies itself as Dynamic Labs API SDK source, while the inspected MetaMask dependencies expose client and protocol code without install hooks.
.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/0/npm-linux/package.jsonFindings
10 Low
LowScripts Present
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/0/npm-linux/package.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/0/npm-linux/src/index.js
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/1/npm-linux/package.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/2/npm-linux/package.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/2/npm-linux/dist/index.js
LowAi Review Evidence.lpm-dependency-evidence-b5f26eed-5f0f-4769-956d-8515f484600c/0/npm-linux/src/apis/SDKApi.js
Low
Affected versions and remediation
This report applies to @dynamic-labs-sdk/metamask@1.46.0.
See all versions of @dynamic-labs-sdk/metamask for other recorded verdicts.
- Review the evidence and your use of @dynamic-labs-sdk/metamask@1.46.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.