registry / @upcoming/multichain-widget / 0.11.1
@upcoming/multichain-widget@0.11.1
⚠ Under review``` npm install @upcoming/multichain-widget ```
Static Scan Results
scanned 4h ago · by rust-scannerStatic analysis completed at 86.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
CryptoDynamicRequireEnvironmentVarsEvalNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/multichain-widget.umd.js6.40 MB file, sampled 256 KB
Source & flagged code
6 flaggeddist/multichain-widget.umd.jsView file
1(function(Qd,K){typeof exports=="object"&&typeof module<"u"?K(exports,require("react"),require("react-dom")):typeof define=="function"&&define.amd?define(["exports","react","react-...
L2: let props = %s;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/multichain-widget.umd.jsView on unpkg · L1•path = dist/multichain-widget.umd.js
kind = oversized_source_file
sizeBytes = 6714732
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/multichain-widget.umd.jsView on unpkgdist/core-CdHvcQdV.mjsView file
5WC_NAME_SUFFIX_LEGACY: ".wcn.id",
L6: BLOCKCHAIN_API_RPC_URL: "https://rpc.walletconnect.org",
L7: PULSE_API_URL: "https://pulse.walletconnect.org",
...
L61: UNSUPPORTED_NETWORK_NAME: "Unknown Network",
L62: SECURE_SITE_SDK_ORIGIN: (typeof process < "u" && typeof process.env < "u" ? process.env.NEXT_PUBLIC_SECURE_SITE_ORIGIN : void 0) || "https://secure.walletconnect.org"
L63: }, Ql = {
...
L744: const e = _e({
L745: data: Array.from([]),
L746: has(s) {
...
L921: if (t)
L922: return JSON.parse(t);
L923: } catch {
Findings
2 Critical2 High5 Medium4 Low
CriticalCredential Exfiltrationdist/core-CdHvcQdV.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/core-CdHvcQdV.mjs
HighTrigger Reachable Credential Exfiltrationdist/core-CdHvcQdV.mjs
HighSemantic Analysis Limiteddist/index-Nz5c5nlH.mjs
MediumDynamic Requiredist/multichain-widget.umd.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/multichain-widget.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @upcoming/multichain-widget@0.11.1.
See all versions of @upcoming/multichain-widget for other recorded verdicts.
- Review the evidence and your use of @upcoming/multichain-widget@0.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.