@dynamic-labs-sdk/metamask@1.48.0
Chain-agnostic primitives for integrating the [MetaMask SDK](https://docs.metamask.io/sdk/) (`@metamask/connect-multichain` and its chain-specific facades such as `@metamask/connect-evm`) with the Dynamic JS SDK.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle scripts, and the inspected entry points defer MetaMask client creation and wallet-provider registration to connection and approval flows. The reviewed storage behavior supports the SDK’s session management and anonymous ID handling.
Decision evidence
public snapshot- The manifest points to JavaScript entry points and declares no install or lifecycle scripts.
- The client manager creates the MetaMask client only when getMetaMaskClient is called.
- Client creation passes app metadata, configured networks, and a storage adapter backed by the host client’s storage service.
- The connection helper starts URI pairing when called; wallet-provider registration occurs in its approval callback.
- The stored anonymous ID is generated with crypto.randomUUID() and persisted through the host storage service.
- The package exposes wallet connection and session storage functions, which are consistent with its MetaMask integration purpose.
- The manifest’s scripts are build, lint, test, and version-check commands.
Source & flagged code
7 flaggedThe manifest points to JavaScript entry points and declares no install or lifecycle scripts.
package.jsonView on unpkg · L1The manifest points to JavaScript entry points and declares no install or lifecycle scripts.
package.jsonView on unpkg · L48Findings
Affected versions and remediation
This report applies to @dynamic-labs-sdk/metamask@1.48.0.
See all versions of @dynamic-labs-sdk/metamask for other recorded verdicts.
- Review the evidence and your use of @dynamic-labs-sdk/metamask@1.48.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.