@funkit/connect-js@0.5.0
Framework-agnostic build of the Funkit Connect SDK
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe Coinbase wallet credential traffic is consistent with the SDK’s wallet connection purpose. However, default runtime logging sends identifying user and wallet fields to Datadog, which meets the review criteria for suspicious telemetry.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A browser app creates a checkout with an API key and normal runtime logging occurs; logging is enabled unless `disableLogging` is set.
Impact
Datadog receives identifying user and account details during checkout activity without an explicit telemetry opt-in.
Mechanism
The logger attaches the API key and user identity fields, including the wallet address, to log context and forwards logs to Datadog.
AI rationale
The Coinbase wallet credential traffic is consistent with the SDK’s wallet connection purpose. However, default runtime logging sends identifying user and wallet fields to Datadog, which meets the review criteria for suspicious telemetry.
Evidence
dist/index.jsdist/dist-KGCCKZNC.js
Network endpoints2
datadoghq.comwww.walletlink.org
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime logging is configured with `disableLogging = false` by default when a checkout API key is supplied.
- Log context includes the API key, user ID, user name, wallet address and login type.
- The checkout populates logger identity fields from user information.
- The logger initializes Datadog and sends log context through its logging API.
Evidence against
- The manifest has no install or lifecycle scripts; the package is a browser checkout SDK.
- The flagged Coinbase wallet requests use session credentials with the walletlink.org API, consistent with wallet connector behavior.
Behavioral surface
CryptoEnvironmentVarsEvalNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/dist-RA6NFQBW.jsView file
32height = width;
L33: return `data:image/svg+xml,%3Csvg width='${width}' height='${height}' viewBox='0 0 1024 1024' fill='none' xmlns='http://www.w3.org/2000/svg'%3E %3Crect width='1024' height='1024' f...
L34: case "circle":
...
L616: const s3 = ensureEvenLengthHexString(str, false);
L617: return Buffer.from(s3, "hex");
L618: }
...
L5588: const handleInstallClick = (0, hooks_1.useCallback)(() => {
L5589: window.open("https://api.wallet.coinbase.com/rpc/v2/desktop/chrome", "_blank");
L5590: }, []);
...
L9108: debug("pipe count=%d opts=%j", state.pipesCount, pipeOpts);
L9109: var doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process.stdout && dest !== process.stderr;
L9110: var endFn = doEnd ? onend : unpipe;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/dist-RA6NFQBW.jsView on unpkg · L3232Trigger-reachable chain: manifest.main -> dist/index.js -> dist/dist-RA6NFQBW.js
L32: height = width;
L33: return `data:image/svg+xml,%3Csvg width='${width}' height='${height}' viewBox='0 0 1024 1024' fill='none' xmlns='http://www.w3.org/2000/svg'%3E %3Crect width='1024' height='1024' f...
L34: case "circle":
...
L616: const s3 = ensureEvenLengthHexString(str, false);
L617: return Buffer.from(s3, "hex");
L618: }
...
L5588: const handleInstallClick = (0, hooks_1.useCallback)(() => {
L5589: window.open("https://api.wallet.coinbase.com/rpc/v2/desktop/chrome", "_blank");
L5590: }, []);
...
L9108: debug("pipe count=%d opts=%j", state.pipesCount, pipeOpts);
L9109: var doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process.stdout && dest !== process.stderr;
L9110: var endFn = doEnd ? o
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationdist/dist-RA6NFQBW.js
CriticalTrigger Reachable Dangerous Capabilitydist/dist-RA6NFQBW.js
HighTrigger Reachable Credential Exfiltrationdist/dist-RA6NFQBW.js
HighSemantic Analysis Limiteddist/chunk-G52B3H63.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @funkit/connect-js@0.5.0.
See all versions of @funkit/connect-js for other recorded verdicts.
- Review the evidence and your use of @funkit/connect-js@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.