@lydianpay/sdk-web@3.10.0
Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe credential-related matches belong to Coinbase Wallet Link’s session-based relay, while the package’s main entry is a web SDK. A bundled WalletConnect component appears to send runtime telemetry by default, and the inspected source does not establish disclosure, an opt-out, or the payload contents, so this merits a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the SDK’s telemetry component is initialized with its default option.
Impact
Potential undisclosed runtime telemetry; the evidence does not show credential exfiltration.
Mechanism
The component posts an event payload to its telemetry endpoint; the reviewed excerpt does not establish what fields the payload contains.
AI rationale
The credential-related matches belong to Coinbase Wallet Link’s session-based relay, while the package’s main entry is a web SDK. A bundled WalletConnect component appears to send runtime telemetry by default, and the inspected source does not establish disclosure, an opt-out, or the payload contents, so this merits a warning rather than a block.
Evidence
dist/chunks/mountEngine-D78kQHoa.js
Network endpoints2
WalletConnect telemetry endpoint (literal host not established in the reviewed excerpt)www.walletlink.org
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled WalletConnect SDK submits an event payload to its telemetry endpoint.
- The telemetry component enables itself by default when its constructor’s default option is used.
Evidence against
- The package entry exports its web SDK, and its prepublishOnly script is a CI publishing guard rather than an install hook.
- The credential-like Authorization header is built from a link session ID and key, then used for event requests to Coinbase Wallet Link.
- The relay is configured with Coinbase’s Wallet Link service URL.
- No source evidence identified automatic collection or transmission of unrelated credentials or machine details.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunks/metamask-sdk-D7OTwvM8.jsView file
13374try {
L13375: const n = require("@react-native-async-storage/async-storage").default, r = yield n.getItem(e);
L13376: if (r) return r;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunks/metamask-sdk-D7OTwvM8.jsView on unpkg · L13374dist/chunks/mountEngine-D78kQHoa.jsView file
7}
L8: const W8 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: vE
L625: ], z_ = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], L_ = ["accountsChanged", "chainChanged"], $_ = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "\\" + s.charCodeAt(0).toString(16) + " ";
L2322: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Findings
2 Critical2 High4 Medium6 Low
CriticalCredential Exfiltrationdist/chunks/mountEngine-D78kQHoa.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-D78kQHoa.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-D78kQHoa.js
HighSemantic Analysis Limiteddist/chunks/mountEngine-D78kQHoa.js
MediumDynamic Requiredist/chunks/metamask-sdk-D7OTwvM8.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@3.10.0.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@3.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.