registry / @upcoming/multichain-widget / 0.13.0
@upcoming/multichain-widget@0.13.0
``` npm install @upcoming/multichain-widget ```
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged environment variable is an optional Rainbow provider key sent to Rainbow’s own endpoint. The widget’s helper-key export is a user-triggered local recovery download, and the manifest has no install lifecycle hooks.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The widget runs when imported or rendered; helper-key export requires a user click.
Impact
No unauthorized credential disclosure or automatic wallet action was identified.
Mechanism
The reviewed credential flow sends an optional Rainbow provider key to Rainbow’s provider endpoint. The helper-key export creates a local download and does not send keys to a remote host.
AI rationale
The flagged environment variable is an optional Rainbow provider key sent to Rainbow’s own endpoint. The widget’s helper-key export is a user-triggered local recovery download, and the manifest has no install lifecycle hooks.
Network endpoints2
enhanced-provider.rainbow.meapi.relay.link
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the built widget and declares no install, preinstall, or postinstall hook.
- The optional RAINBOW_PROVIDER_API_KEY is sent as an x-api-key to Rainbow’s own enhanced-provider.rainbow.me endpoint.
- Helper private keys are read from the widget’s own local-storage namespace and downloaded locally only through an explicitly labeled export control for recovery.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/index-ClaJMdfg.mjsView file
78function KI() {
L79: return Y6 || (Y6 = 1, process.env.NODE_ENV !== "production" && (function() {
L80: function e(H) {
...
L170: G || (G = !0, console.error(
L171: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L172: re
...
L358: fonts: {
L359: body: JI[t]
L360: },
...
L3024: let n = Jt(e);
L3025: return t.size && (jn(n, { size: t.size }), n = Ft(n, { dir: "right" })), new TextDecoder().decode(n);
L3026: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index-ClaJMdfg.mjsView on unpkg · L78dist/multichain-widget.umd.jsView file
1Trigger-reachable chain: manifest.main -> dist/multichain-widget.umd.js
L1: (function(fl,G){typeof exports=="object"&&typeof module<"u"?G(exports,require("react"),require("react-dom")):typeof define=="function"&&define.amd?define(["exports","react","react-...
L2: let props = %s;
...
L5: let props = %s;
L6: <%s key={someKey} {...props} />`,$,Z,Y,Z),j[Z+$]=!0)}if(Z=null,L!==void 0&&(u(L),Z=""+L),s(z)&&(u(z.key),Z=""+z.key),"key"in z){L={};for(var J in z)J!=="key"&&(L[J]=z[J])}else L=z;...
L7: "connect_wallet": {
...
L1594: `),{name:"InvalidArrayError"})}},CIe=class extends ke{constructor(t){super([`"${t}" is not a valid definition type.`,'Valid types: "function", "event", "error"'].join(`
L1595: `),{name:"InvalidDefinitionTypeError"})}},Bn=class extends ke{constructor({address:t}){super(`Add
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index-ClaJMdfg.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/multichain-widget.umd.js
HighTrigger Reachable Credential Exfiltrationdist/multichain-widget.umd.js
HighSemantic Analysis Limiteddist/index.es-BQ9KDKsK.mjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/multichain-widget.umd.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @upcoming/multichain-widget@0.13.0.
See all versions of @upcoming/multichain-widget for other recorded verdicts.
- Review the evidence and your use of @upcoming/multichain-widget@0.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.