registry / @upcoming/multichain-widget / 0.12.0
@upcoming/multichain-widget@0.12.0
⚠ Under review``` npm install @upcoming/multichain-widget ```
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
dist/multichain-widget.umd.js5.47 MB file, sampled 256 KB
Source & flagged code
5 flaggeddist/index-DHjHvUZT.mjsView file
78function OI() {
L79: return V6 || (V6 = 1, process.env.NODE_ENV !== "production" && (function() {
L80: function e(H) {
...
L170: G || (G = !0, console.error(
L171: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L172: te
...
L358: fonts: {
L359: body: RI[t]
L360: },
...
L3024: let n = Xt(e);
L3025: return t.size && (Rn(n, { size: t.size }), n = Ot(n, { dir: "right" })), new TextDecoder().decode(n);
L3026: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index-DHjHvUZT.mjsView on unpkg · L78dist/multichain-widget.umd.jsView file
1Trigger-reachable chain: manifest.main -> dist/multichain-widget.umd.js
L1: (function(pl,V){typeof exports=="object"&&typeof module<"u"?V(exports,require("react"),require("react-dom")):typeof define=="function"&&define.amd?define(["exports","react","react-...
L2: let props = %s;
...
L5: let props = %s;
L6: <%s key={someKey} {...props} />`,$,Z,Y,Z),j[Z+$]=!0)}if(Z=null,L!==void 0&&(u(L),Z=""+L),s(z)&&(u(z.key),Z=""+z.key),"key"in z){L={};for(var J in z)J!=="key"&&(L[J]=z[J])}else L=z;...
L7: "connect_wallet": {
...
L1594: `),{name:"InvalidArrayError"})}},rIe=class extends ke{constructor(t){super([`"${t}" is not a valid definition type.`,'Valid types: "function", "event", "error"'].join(`
L1595: `),{name:"InvalidDefinitionTypeError"})}},Dn=class extends ke{constructor({address:t}){super(`Add
Findings
2 Critical2 High4 Medium3 Low
CriticalCredential Exfiltrationdist/index-DHjHvUZT.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/multichain-widget.umd.js
HighTrigger Reachable Credential Exfiltrationdist/multichain-widget.umd.js
HighSemantic Analysis Limiteddist/multichain-widget.umd.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/multichain-widget.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @upcoming/multichain-widget@0.12.0.
See all versions of @upcoming/multichain-widget for other recorded verdicts.
- Review the evidence and your use of @upcoming/multichain-widget@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.