registry / @lydianpay/sdk-web

@lydianpay/sdk-web

⚠ Under review

Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.

This report shows the evidence for @lydianpay/sdk-web@3.15.5. 0 of 30 known versions are blocked or flagged. See all versions.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 86.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 2.39 MB of source, external domains: addons.mozilla.org, api.lydian.com, api.lydian.dev, api.sandbox.lydian.com, apps.apple.com, aw.app, bitpay.onelink.me, bkapp.vip, chain-assets.lydian.com, chat.stenciljs.com, chrome.google.com, chromewebstore.google.com, coin98.com, creativecommons.org, docs.cloud.coinbase.com, echo.walletconnect.com, exodus.com, fonts.googleapis.com, fwd.metamask.io, github.com, go.cb-w.com, gw.arculus.co, imagedelivery.net, itunes.apple.com, keys.coinbase.com, link.bitpay.com, link.foxwallet.com, link.safepal.io, link.trustwallet.com, login.blockchain.com, lydian.com, metamask.app.link, metamask.io, mewwallet.com, mm-sdk-analytics.api.cx.metamask.io, oxlib.sh, pay.lydian.com, play.google.com, pulse.walletconnect.org, purl.org, raw.githubusercontent.com, react.dev, rnbwapp.com, rpc.wallet.coinbase.com, rpc.walletconnect.org, stenciljs.com, t.me, tailwindcss.com, tetherpay.com, verify.walletconnect.com

Source & flagged code

5 flagged

dist/chunks/index-FAg0du7P.jsView file

26case "mm-install-modal_2": L27: return import( L28: /* webpackMode: "lazy" */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/index-FAg0du7P.jsView on unpkg · L26

dist/chunks/mountEngine-Bk-qJ-ZC.jsView file

7} L8: const $_ = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca... L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps ... L637: VE L638: ], CA = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], TA = ["accountsChanged", "chainChanged"], DA = [ L639: "solana_signTransaction", ... L782: payButtonsSlot: "#payButtonsSlot", L783: closeDialogBody: "#modalCloseTransactionModal .modal-body", L784: restoreDialogBody: "#modalRestoreDetails .modal-body" ... L2339: function(s) { L2340: return "\\" + s.charCodeAt(0).toString(16) + " "; L2341: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/mountEngine-Bk-qJ-ZC.js

Findings

2 Critical2 High4 Medium5 Low

CriticalCredential Exfiltrationdist/chunks/mountEngine-Bk-qJ-ZC.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-Bk-qJ-ZC.js

HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-Bk-qJ-ZC.js

HighSemantic Analysis Limiteddist/chunks/mountEngine-Bk-qJ-ZC.js

MediumDynamic Requiredist/chunks/index-FAg0du7P.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @lydianpay/sdk-web@3.15.5.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @lydianpay/sdk-web@3.15.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 21:56:20.991Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

30 known versions

3.15.5latestshownUnknown—AllowUnder ReviewNov 4, 2026, 9:52 PM 3.15.4Clean—AllowPublishedOct 30, 2026, 1:10 AM 3.15.2SuspiciousTelemetryWarnPublishedOct 29, 2026, 7:51 PM 3.15.1Clean—AllowPublishedOct 28, 2026, 5:30 AM

registry / @lydianpay/sdk-web

@lydianpay/sdk-web

⚠ Under review

Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.

This report shows the evidence for @lydianpay/sdk-web@3.15.5. 0 of 30 known versions are blocked or flagged. See all versions.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 86.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/chunks/index-FAg0du7P.jsView file

26case "mm-install-modal_2": L27: return import( L28: /* webpackMode: "lazy" */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/index-FAg0du7P.jsView on unpkg · L26

dist/chunks/mountEngine-Bk-qJ-ZC.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunks/mountEngine-Bk-qJ-ZC.js

Findings

2 Critical2 High4 Medium5 Low

CriticalCredential Exfiltrationdist/chunks/mountEngine-Bk-qJ-ZC.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-Bk-qJ-ZC.js

HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-Bk-qJ-ZC.js

HighSemantic Analysis Limiteddist/chunks/mountEngine-Bk-qJ-ZC.js

MediumDynamic Requiredist/chunks/index-FAg0du7P.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @lydianpay/sdk-web@3.15.5.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @lydianpay/sdk-web@3.15.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 21:56:20.991Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

30 known versions