registry / @lydianpay/sdk-web / 2.0.3
@lydianpay/sdk-web@2.0.3
⚠ Under reviewDrop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/chunks/index-DJf7Eh8P.jsView file
3var Ce = (t, e, s) => R0(t, typeof e != "symbol" ? e + "" : e, s);
L4: const P0 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L5: <div id="paymentHeaderSlot"></div>
...
L783: if (!nt(fe, uo(ne, ye, ""))) {
L784: if (!((Y === "src" || Y === "xlink:href" || Y === "href") && R !== "script" && uh(ne, "data:") === 0 && st[R])) {
L785: if (!(V && !nt(he, uo(ne, ye, "")))) {
...
L1541: $f
L1542: ], r1 = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], c1 = ["accountsChanged", "chainChanged"], l1 = [
L1543: "solana_signTransaction",
...
L1879: if (a.ok)
L1880: return await a.json();
L1881: throw new Error(a.statusText);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunks/index-DJf7Eh8P.jsView on unpkg · L33Trigger-reachable chain: manifest.main -> dist/lydian.js -> dist/chunks/index-DJf7Eh8P.js
L3: var Ce = (t, e, s) => R0(t, typeof e != "symbol" ? e + "" : e, s);
L4: const P0 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L5: <div id="paymentHeaderSlot"></div>
...
L783: if (!nt(fe, uo(ne, ye, ""))) {
L784: if (!((Y === "src" || Y === "xlink:href" || Y === "href") && R !== "script" && uh(ne, "data:") === 0 && st[R])) {
L785: if (!(V && !nt(he, uo(ne, ye, "")))) {
...
L1541: $f
L1542: ], r1 = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], c1 = ["accountsChanged", "chainChanged"], l1 = [
L1543: "solana_signTransaction",
...
L1879: if (a.ok)
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/chunks/index-DJf7Eh8P.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/index-DJf7Eh8P.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/index-DJf7Eh8P.js
HighSemantic Analysis Limiteddist/chunks/index-DJf7Eh8P.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@2.0.3.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@2.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.