registry / @lydianpay/sdk-web / 3.14.0
@lydianpay/sdk-web@3.14.0
Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no install-time hook, and the inspected runtime credential flow uses Lydian session credentials for the SDK’s link-event API. Runtime loading and network activity are consistent with checkout initialization and the package’s stated purpose.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Checkout API requests and link-event synchronization occur during checkout initialization and session handling.
Impact
No malicious impact identified in the inspected source.
Mechanism
The SDK sends configured checkout data to Lydian gateway endpoints and uses session credentials for its link-event API.
AI rationale
The manifest has no install-time hook, and the inspected runtime credential flow uses Lydian session credentials for the SDK’s link-event API. Runtime loading and network activity are consistent with checkout initialization and the package’s stated purpose.
Network endpoints3
api.lydian.devapi.sandbox.lydian.comapi.lydian.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports a browser bundle; its only lifecycle script is prepublishOnly, which is not an install hook.
- The checkout engine is loaded during initialize(), after checkout options are supplied.
- The flagged Basic-auth value is built from a Lydian session ID and key and is used for link-event API requests.
- The default gateway hosts are Lydian API endpoints, and callers can configure a gateway URL.
Evidence against
- The scanner flags credential and environment access, but the inspected credential flow concerns Lydian session credentials used by the SDK’s link-event client.
- The main bundle registers the checkout web component at import time, consistent with the package’s stated purpose.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunks/mountEngine-0u7my-Xz.jsView file
7}
L8: const __ = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L637: zE
L638: ], fA = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], dA = ["accountsChanged", "chainChanged"], hA = [
L639: "solana_signTransaction",
...
L773: payButtonsSlot: "#payButtonsSlot",
L774: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L775: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2330: function(s) {
L2331: return "\\" + s.charCodeAt(0).toString(16) + " ";
L2332: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunks/mountEngine-0u7my-Xz.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> dist/lydian.js -> dist/chunks/index-DDKaYwMc.js -> dist/chunks/mountEngine-0u7my-Xz.js
L7: }
L8: const __ = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L637: zE
L638: ], fA = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], dA = ["accountsChanged", "chainChanged"], hA = [
L639: "solana_signTransaction",
...
L773: payButtonsSlot: "#payButtonsSlot",
L774: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L775: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2330: function(s) {
L2331: return "
Findings
2 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunks/mountEngine-0u7my-Xz.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-0u7my-Xz.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-0u7my-Xz.js
HighSemantic Analysis Limiteddist/chunks/mountEngine-0u7my-Xz.js
MediumDynamic Requiredist/chunks/mountEngine-0u7my-Xz.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@3.14.0.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@3.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.