registry / @lydianpay/sdk-web / 3.13.1
@lydianpay/sdk-web@3.13.1
Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest exposes the bundled checkout SDK without install-time hooks. The flagged credential flow uses a wallet-link session credential with the configured link API, and the related notification request sends a client notification token; neither indicates unrelated credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Wallet and notification activity during checkout; event telemetry is enabled through the WalletConnect SDK.
Impact
The inspected behavior does not show unrelated credential collection or account actions.
Mechanism
Session authorization is sent to the configured Coinbase Wallet link API, and the notification token is posted to a project-specific endpoint.
AI rationale
The manifest exposes the bundled checkout SDK without install-time hooks. The flagged credential flow uses a wallet-link session credential with the configured link API, and the related notification request sends a client notification token; neither indicates unrelated credential exfiltration.
Network endpoints1
pulse.walletconnect.org/batch
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point is the built distribution, and the manifest declares no install, preinstall, or postinstall hook.
- The checkout engine is loaded when initialization is requested; source comments say it is not started just because the page carries the component.
- The flagged Basic authorization value is formed from a Coinbase Wallet link session ID and secret, then sent to the supplied link API URL.
- The WalletConnect notification registration sends a client ID and notification token to a project-specific clients endpoint.
Evidence against
- The code includes WalletConnect event telemetry sent to its pulse endpoint; the inspected excerpt does not show collection of credentials or machine details.
- The payment checkout purpose includes wallet linking and notification registration, which are consistent with the reviewed network behavior.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalNetworkWebSocket
Source & flagged code
5 flaggeddist/chunks/metamask-sdk-BIbC0y1P.jsView file
13374try {
L13375: const n = require("@react-native-async-storage/async-storage").default, r = yield n.getItem(e);
L13376: if (r) return r;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunks/metamask-sdk-BIbC0y1P.jsView on unpkg · L13374dist/chunks/mountEngine-BIIdZhCT.jsView file
7}
L8: const b_ = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L637: RE
L638: ], aA = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], oA = ["accountsChanged", "chainChanged"], lA = [
L639: "solana_signTransaction",
...
L778: payButtonsSlot: "#payButtonsSlot",
L779: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L780: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2335: function(s) {
L2336: return "\\" + s.charCodeAt(0).toString(16) + " ";
L2337: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Findings
2 Critical2 High4 Medium6 Low
CriticalCredential Exfiltrationdist/chunks/mountEngine-BIIdZhCT.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-BIIdZhCT.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-BIIdZhCT.js
HighSemantic Analysis Limiteddist/chunks/mountEngine-BIIdZhCT.js
MediumDynamic Requiredist/chunks/metamask-sdk-BIbC0y1P.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@3.13.1.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@3.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.