registry / @paysponge/sdk / 0.1.146

@paysponge/sdk@0.1.146

SDK for spinning up wallets for AI agents with Claude Agent SDK integration

Static Scan Results

scanned 33m ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 200 file(s), 1.19 MB of source, external domains: api.example.com, api.wallet.paysponge.com, app.example.com, docs.paysponge.com, registry.npmjs.org, us.i.posthog.com, wallet.paysponge.com

Source & flagged code

1 flagged

dist/auth/device-flow.jsView file

Lines 15-55javascript

15 * 4. Polls for token until approved or expired

16 * 5. Saves credentials and returns the API key

17 */

18export async function deviceFlowAuth(options = {}) {

19 const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;

20 const startedAt = Date.now();

21 try {

22 // Step 1: Request device code

23 console.log("Starting authentication...\n");

24 const deviceCodeResponse = await requestDeviceCode(baseUrl, {

25 testnet: options.testnet,

26 agentName: options.agentName,

27 keyType: options.keyType,

28 email: options.email,

29 });

30 // Step 2: Display instructions and optionally open browser

31 console.log("To authenticate, visit:");

32 console.log(` ${deviceCodeResponse.verificationUri}\n`);

33 console.log(`Enter this code: ${deviceCodeResponse.userCode}\n`);

34 // Try to copy to clipboard

35 try {

36 const clipboardy = await import("clipboardy");

37 await clipboardy.default.write(deviceCodeResponse.userCode);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/auth/device-flow.jsView on unpkg · L35

38 console.log("(Code copied to clipboard)\n");

39 }

40 catch {

41 // Clipboard not available, that's fine

42 }

43 // Try to open browser

44 if (!options.noBrowser) {

45 try {

46 const open = await import("open");

47 await open.default(deviceCodeResponse.verificationUri);

48 console.log("Opening browser...\n");

49 }

50 catch {

51 // Browser not available, that's fine

52 }

53 }

54 console.log("Waiting for approval...");

55 // Step 3: Poll for token

Source & flagged code

1 flagged · loading source

dist/auth/device-flow.jsView file

35package = @paysponge/sdk; repositoryIdentity = sponge; dependency = clipboardy L35: try { L36: const clipboardy = await import("clipboardy"); L37: await clipboardy.default.write(deviceCodeResponse.userCode);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/auth/device-flow.jsView on unpkg · L35

Findings

1 High3 Medium6 Low

HighCopied Package Dependency Bridgedist/auth/device-flow.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/auth/device-flow.jsView file

Lines 15-55javascript

15 * 4. Polls for token until approved or expired

16 * 5. Saves credentials and returns the API key

17 */

18export async function deviceFlowAuth(options = {}) {

19 const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;

20 const startedAt = Date.now();

21 try {

22 // Step 1: Request device code

23 console.log("Starting authentication...\n");

24 const deviceCodeResponse = await requestDeviceCode(baseUrl, {

25 testnet: options.testnet,

26 agentName: options.agentName,

27 keyType: options.keyType,

28 email: options.email,

29 });

30 // Step 2: Display instructions and optionally open browser

31 console.log("To authenticate, visit:");

32 console.log(` ${deviceCodeResponse.verificationUri}\n`);

33 console.log(`Enter this code: ${deviceCodeResponse.userCode}\n`);

34 // Try to copy to clipboard

35 try {

36 const clipboardy = await import("clipboardy");

37 await clipboardy.default.write(deviceCodeResponse.userCode);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/auth/device-flow.jsView on unpkg · L35

38 console.log("(Code copied to clipboard)\n");

39 }

40 catch {

41 // Clipboard not available, that's fine

42 }

43 // Try to open browser

44 if (!options.noBrowser) {

45 try {

46 const open = await import("open");

47 await open.default(deviceCodeResponse.verificationUri);

48 console.log("Opening browser...\n");

49 }

50 catch {

51 // Browser not available, that's fine

52 }

53 }

54 console.log("Waiting for approval...");

55 // Step 3: Poll for token