registry / @lydianpay/sdk-web / 3.4.0
@lydianpay/sdk-web@3.4.0
Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged authorization is derived from a wallet-link session and sent to its configured Coinbase Wallet service; the reviewed entry and lifecycle script show no automatic credential collection or install-time contact. The package’s observed network behavior fits a web checkout and wallet-connect SDK.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Wallet connection and telemetry occur through SDK runtime behavior; the checkout engine loads during initialization.
Impact
No unauthorized collection, credential exfiltration, or other harmful impact was identified.
Mechanism
Wallet-link requests use a session-derived Basic authorization value at the configured Coinbase Wallet link server. WalletConnect event submission is guarded by its telemetry-enabled setting.
AI rationale
The flagged authorization is derived from a wallet-link session and sent to its configured Coinbase Wallet service; the reviewed entry and lifecycle script show no automatic credential collection or install-time contact. The package’s observed network behavior fits a web checkout and wallet-connect SDK.
Network endpoints3
rpc.walletconnect.org/v1verify.walletconnect.comverify.walletconnect.org
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry loads its SDK bundle, and the `prepublishOnly` script only guards publishing through CI.
- The checkout engine is loaded when initialization requests it, rather than when the entry module is imported.
- The flagged Basic authorization is formed from a wallet-link session ID and secret and sent to the configured Coinbase Wallet link server.
- The WalletConnect event sender is guarded by a telemetry-enabled flag; telemetry is not sent when that flag is false.
Evidence against
- The scanner flagged possible credential exfiltration, but the reviewed flow uses a wallet-link session credential for the documented wallet service.
- The package declares no install, preinstall, or postinstall hook.
Behavioral surface
CryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/chunks/mountEngine-B8FwMr2r.jsView file
7}
L8: const xA = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: cx
L625: ], u8 = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], f8 = ["accountsChanged", "chainChanged"], d8 = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "\\" + s.charCodeAt(0).toString(16) + " ";
L2322: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunks/mountEngine-B8FwMr2r.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> dist/lydian.js -> dist/chunks/index-B0BHysWS.js -> dist/chunks/mountEngine-B8FwMr2r.js
L7: }
L8: const xA = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: cx
L625: ], u8 = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], f8 = ["accountsChanged", "chainChanged"], d8 = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/chunks/mountEngine-B8FwMr2r.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-B8FwMr2r.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-B8FwMr2r.js
HighSemantic Analysis Limiteddist/chunks/mountEngine-B8FwMr2r.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@3.4.0.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@3.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.