registry / @hfunlabs/hypurr-connect / 0.1.27

@hfunlabs/hypurr-connect@0.1.27

React authentication and wallet connectivity library for the [Hyperliquid](https://hyperliquid.xyz) decentralized exchange via the [Hypurr](https://hypurr.fun) gRPC backend. Provides two authentication paths — **Telegram OAuth** and **EOA wallet** (MetaMa

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a React wallet/auth connector whose network and localStorage usage are aligned with its documented Hypurr/Hyperliquid functionality.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports the library and invokes React auth/wallet flows.

Impact

Expected app authentication/trading behavior; no evidence of hidden credential harvesting or exfiltration.

Mechanism

OAuth token exchange, gRPC/HTTP exchange transport, and browser localStorage session persistence.

Rationale

Static source inspection shows package-aligned OAuth, gRPC, Hyperliquid API, and browser storage behavior, with no hidden install-time execution or exfiltration primitives. The prepare script and git dependency are not enough to classify this published package as malicious.

Evidence

package.jsonREADME.mdsrc/index.tssrc/grpc.tssrc/HypurrConnectProvider.tsxsrc/GrpcExchangeTransport.tssrc/agent.tssrc/privateKeySigner.tsdist/index.jsbrowser localStorage keys hypurr-connect-tg-jwt, hypurr-connect-tg-refresh-token, hypurr-connect-agent:<address>browser sessionStorage keys hypurr-connect-tg-auth-*

Network endpoints11

grpc.hypurr.funauth.hypurr.fun/loginmedia.hypurr.funapi.hyperliquid.xyzapi.hyperliquid.xyz/infoapi.hyperliquid.xyz/exchangeapi-ui.hyperliquid-testnet.xyz/exchangeapi.hyperliquid-testnet.xyzapi.hyperliquid-testnet.xyz/infoapi.hyperliquid-testnet.xyz/exchangefonts.googleapis.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json has a prepare script of "husky", but no install/postinstall hook.
package.json depends on git source hypurr-grpc, a supply-chain risk but not package code execution by itself.
src/agent.ts stores generated agent private keys in browser localStorage for the app's wallet flow.

Evidence against

src/index.ts only imports CSS and exports React components/helpers; no import-time exfiltration found.
src/grpc.ts and src/HypurrConnectProvider.tsx network calls target Hypurr auth/gRPC endpoints for OAuth and service RPCs.
src/GrpcExchangeTransport.ts and src/agent.ts call Hyperliquid API endpoints for exchange/info operations matching README purpose.
No child_process, fs access, eval/new Function, process.env harvesting, or AI-agent control-surface writes found.
README documents Telegram OAuth, gRPC backend, Hyperliquid exchange, and localStorage session/agent behavior.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependencyNoLicense

scanned 22 file(s), 480 KB of source, external domains: api-ui.hyperliquid-testnet.xyz, api.hyperliquid-testnet.xyz, api.hyperliquid.xyz, auth.hypurr.fun, fonts.googleapis.com, grpc.hypurr.fun, media.hypurr.fun, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 14-54json

14 },

15 "publishConfig": {

16 "access": "public",

17 "registry": "https://registry.npmjs.org/"

18 },

19 "files": [

20 "dist",

21 "src"

22 ],

23 "sideEffects": [

24 "**/*.css",

25 "./dist/index.js"

26 ],

27 "scripts": {

28 "build": "pnpm build:css && tsup",

29 "build:css": "tailwindcss -c ./tailwind.config.cjs -i ./src/tailwind.css -o ./src/styles.css --minify",

30 "dev": "pnpm build:css && tsup --watch",

31 "lint": "eslint .",

32 "typecheck": "tsc --noEmit",

33 "format": "pnpm prettier --write .",

34 "prepare": "husky"

Low

Suspicious Lifecycle Evidence

package.json has a prepare script of "husky", but no install/postinstall hook.

package.jsonView on unpkg · L34

35 },

36 "lint-staged": {

37 "*.{ts,tsx,js,jsx,json,css,md,yaml,yml}": "prettier --write"

38 },

39 "peerDependencies": {

40 "@hfunlabs/hyperliquid": ">=0.30.2-hfunlabs.2 <0.33.0",

41 "@protobuf-ts/grpcweb-transport": ">=2.0.0",

42 "@protobuf-ts/runtime-rpc": ">=2.0.0",

43 "framer-motion": ">=10.0.0",

44 "react": ">=18.0.0"

45 },

46 "devDependencies": {

47 "@eslint/js": "^9.39.3",

48 "@hfunlabs/hyperliquid": "0.32.2-hfunlabs.2",

49 "@protobuf-ts/grpcweb-transport": "^2.11.1",

50 "@protobuf-ts/runtime-rpc": "^2.11.1",

51 "@types/react": "^19.2.14",

52 "eslint": "^9.39.3",

53 "eslint-plugin-react-hooks": "^5.2.0",

54 "framer-motion": "^12.34.5",

•Published source reference

Low

Ai Review Evidence

package.json depends on git source hypurr-grpc, a supply-chain risk but not package code execution by itself.

package.jsonView on unpkg

src/agent.tsView file

•Published source reference

Low

Ai Review Evidence

src/agent.ts stores generated agent private keys in browser localStorage for the app's wallet flow.

src/agent.tsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•Published source reference

Low

Suspicious Lifecycle Evidence

package.json has a prepare script of "husky", but no install/postinstall hook.

package.jsonView on unpkg

•Published source reference

Low

Ai Review Evidence

package.json depends on git source hypurr-grpc, a supply-chain risk but not package code execution by itself.

package.jsonView on unpkg

src/agent.tsView file

•Published source reference

Low

Ai Review Evidence

src/agent.ts stores generated agent private keys in browser localStorage for the app's wallet flow.

src/agent.tsView on unpkg

Findings

2 Medium8 Low

MediumNetwork

MediumGit Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencepackage.json

LowAi Review Evidencesrc/agent.ts

Source & flagged code

3 flagged

package.jsonView file

Lines 14-54json

14 },

15 "publishConfig": {

16 "access": "public",

17 "registry": "https://registry.npmjs.org/"

18 },

19 "files": [

20 "dist",

21 "src"

22 ],

23 "sideEffects": [

24 "**/*.css",

25 "./dist/index.js"

26 ],

27 "scripts": {

28 "build": "pnpm build:css && tsup",

29 "build:css": "tailwindcss -c ./tailwind.config.cjs -i ./src/tailwind.css -o ./src/styles.css --minify",

30 "dev": "pnpm build:css && tsup --watch",

31 "lint": "eslint .",

32 "typecheck": "tsc --noEmit",

33 "format": "pnpm prettier --write .",

34 "prepare": "husky"

Low

Suspicious Lifecycle Evidence

package.json has a prepare script of "husky", but no install/postinstall hook.

package.jsonView on unpkg · L34

35 },

36 "lint-staged": {

37 "*.{ts,tsx,js,jsx,json,css,md,yaml,yml}": "prettier --write"

38 },

39 "peerDependencies": {

40 "@hfunlabs/hyperliquid": ">=0.30.2-hfunlabs.2 <0.33.0",

41 "@protobuf-ts/grpcweb-transport": ">=2.0.0",

42 "@protobuf-ts/runtime-rpc": ">=2.0.0",

43 "framer-motion": ">=10.0.0",

44 "react": ">=18.0.0"

45 },

46 "devDependencies": {

47 "@eslint/js": "^9.39.3",

48 "@hfunlabs/hyperliquid": "0.32.2-hfunlabs.2",

49 "@protobuf-ts/grpcweb-transport": "^2.11.1",

50 "@protobuf-ts/runtime-rpc": "^2.11.1",

51 "@types/react": "^19.2.14",

52 "eslint": "^9.39.3",

53 "eslint-plugin-react-hooks": "^5.2.0",

54 "framer-motion": "^12.34.5",

•Published source reference

Low

Ai Review Evidence

package.json depends on git source hypurr-grpc, a supply-chain risk but not package code execution by itself.

package.jsonView on unpkg

src/agent.tsView file

•Published source reference

Low

Ai Review Evidence

src/agent.ts stores generated agent private keys in browser localStorage for the app's wallet flow.

src/agent.tsView on unpkg