@lydianpay/sdk-web@3.7.2
Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundle enables WalletConnect telemetry by default and sends app-domain and runtime metadata to WalletConnect Pulse, without a visible opt-out in this package’s initialization path. This supports a warning for undisclosed runtime telemetry, not a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The WalletConnect client initializes during the checkout wallet-connection flow.
Impact
WalletConnect can receive information about the app using the SDK and its runtime use; the inspected flow does not show credential theft or unrelated actions.
Mechanism
The bundled event client sends telemetry batches containing the app domain, a client ID, user-agent data, and event metadata to WalletConnect Pulse.
AI rationale
The bundle enables WalletConnect telemetry by default and sends app-domain and runtime metadata to WalletConnect Pulse, without a visible opt-out in this package’s initialization path. This supports a warning for undisclosed runtime telemetry, not a malicious verdict.
Evidence
dist/chunks/mountEngine-Dd6Llndl.js
Network endpoints1
pulse.walletconnect.org/batch
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The bundled WalletConnect event client defaults telemetry to enabled.
- Its initialization event includes the app domain, a client ID, and user-agent data.
- Telemetry batches are posted to https://pulse.walletconnect.org/batch.
- The checkout lazily loads the engine, which initializes the WalletConnect client when requested.
- The checkout API sends its publishable key to the configured base URI.
Evidence against
- The observed telemetry contains runtime and app-domain metadata, not credentials or file contents.
- The package is a crypto checkout SDK, and the WalletConnect traffic is part of its wallet-connection flow.
- The flagged Basic authorization is formed from session values and sent to the configured link API.
Behavioral surface
CryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/chunks/mountEngine-Dd6Llndl.jsView file
7}
L8: const F8 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: mE
L625: ], N_ = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], I_ = ["accountsChanged", "chainChanged"], R_ = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "\\" + s.charCodeAt(0).toString(16) + " ";
L2322: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunks/mountEngine-Dd6Llndl.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> dist/lydian.js -> dist/chunks/index-BRfoKKIF.js -> dist/chunks/mountEngine-Dd6Llndl.js
L7: }
L8: const F8 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: mE
L625: ], N_ = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], I_ = ["accountsChanged", "chainChanged"], R_ = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/chunks/mountEngine-Dd6Llndl.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-Dd6Llndl.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-Dd6Llndl.js
HighSemantic Analysis Limiteddist/chunks/mountEngine-Dd6Llndl.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@3.7.2.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@3.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.