@verified-network/verified-sdk@2.9.2
An SDK to develop applications on the Verified Network
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe code creates a concrete private-key disclosure path during normal SDK operations. It is not automatic at installation, so the evidence supports a warning rather than a publication block.
Static reason
No blocking static signals were detected.
Trigger
Calling a contract quote or gasless transaction path with a signer and payment token.
Impact
The remote service and intermediary logs can receive a wallet private key, allowing loss of control over that wallet.
Mechanism
Extracts a signer private key and sends it in sponsor-service requests.
AI rationale
The code creates a concrete private-key disclosure path during normal SDK operations. It is not automatic at installation, so the evidence supports a warning rather than a publication block.
Evidence
dist/contract/index.js
Network endpoints1
gateway.verified.network/api/sponsor
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The contract helper extracts the signer's private key and includes it in a request to the hosted sponsor service.
- The quote path places the private key in a GET URL query string, exposing it to network and server logs.
Evidence against
- The manifest has no install lifecycle hook, and the package entry point only exports SDK modules.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading source.yarn/install-state.gzView file
•path = .yarn/install-state.gz
kind = high_entropy_blob
sizeBytes = 226705
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = payload_in_excluded_dir
sizeBytes = 226705
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = compressed_blob
sizeBytes = 226705
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkgdist/abi/assetmanager/Vault.json
Findings
3 High5 Medium3 Low
HighShips High Entropy Blob.yarn/install-state.gz
HighPayload In Excluded Dir.yarn/install-state.gz
HighSemantic Analysis Limiteddist/abi/assetmanager/Vault.json
MediumNetwork
MediumShips Compressed Blob.yarn/install-state.gz
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/contract/index.js
MediumAi Review Evidencedist/contract/index.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @verified-network/verified-sdk@2.9.2.
See all versions of @verified-network/verified-sdk for other recorded verdicts.
- Review the evidence and your use of @verified-network/verified-sdk@2.9.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.