registry  /  @solana/connector  /  0.2.6

@solana/connector@0.2.6

⚠ Under review

Headless wallet connector client and React provider built on Wallet Standard

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
EnvironmentVarsNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 34 file(s), 781 KB of source, external domains: 127.0.0.1, api.coingecko.com, api.devnet.solana.com, api.mainnet-beta.solana.com, api.testnet.solana.com, explorer.solana.com, solana.fm, solscan.io, token-list-api.solana.cloud, xray.helius.xyz

Source & flagged code

2 flagged · loading source
dist/chunk-BF67LVVM.jsView file
8// src/lib/kit/constants.ts L9: var LAMPORTS_PER_SOL = 1e9; L10: function lamportsToSol(lamports) { ... L20: case "devnet": L21: return "https://api.devnet.solana.com"; L22: case "testnet": ... L83: function getMinLogLevel() { L84: return typeof process < "u" && process.env?.CONNECTOR_DEBUG_LEVEL ? process.env.CONNECTOR_DEBUG_LEVEL : typeof globalThis < "u" && globalThis.__CONNECTOR_DEBUG_LEVEL__ ? globalThis... L85: } ... L111: if (blockhashReset || !hasLifetimeConstraint) { L112: let { value: latestBlockhash } = await config.rpc.getLatestBlockhash().send(); L113: hasLifetimeConstraint ? blockhashReset && (isDebugEnabled() && debug("Auto resetting the latest blockhash.", "debug"), transaction = {
Critical
Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/chunk-BF67LVVM.jsView on unpkg · L8
8Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-BF67LVVM.js L8: // src/lib/kit/constants.ts L9: var LAMPORTS_PER_SOL = 1e9; L10: function lamportsToSol(lamports) { ... L20: case "devnet": L21: return "https://api.devnet.solana.com"; L22: case "testnet": ... L83: function getMinLogLevel() { L84: return typeof process < "u" && process.env?.CONNECTOR_DEBUG_LEVEL ? process.env.CONNECTOR_DEBUG_LEVEL : typeof globalThis < "u" && globalThis.__CONNECTOR_DEBUG_LEVEL__ ? globalThis... L85: } ... L111: if (blockhashReset || !hasLifetimeConstraint) { L112: let { value: latestBlockhash } = await config.rpc.getLatestBlockhash().send(); L113: hasLifetimeConstraint ? blockhashReset && (isDebugEnabled() && debug("Auto resetting the latest blockhash.", "debug"), transaction = {
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-BF67LVVM.jsView on unpkg · L8

Findings

2 Critical3 Medium3 Low
CriticalWallet Draindist/chunk-BF67LVVM.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-BF67LVVM.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings