registry / @verified-network/verified-sdk / 2.9.7
@verified-network/verified-sdk@2.9.7
⚠ Under reviewAn SDK to develop applications on the Verified Network
AI Security Review
scanned 15d ago · by lpm-firewall-aiInspected source shows package-aligned sponsorship requests and no install hook. I cannot verify the required compressed Yarn state file, so the package contents are not fully resolved.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes a sponsorship or fee-quote method.
Impact
The inspected behavior supports the SDK's sponsorship flow; the unreadable compressed file prevents a complete package assessment.
Mechanism
The method sends encrypted key material and transaction details to the package's configured sponsorship endpoint.
AI rationale
Inspected source shows package-aligned sponsorship requests and no install hook. I cannot verify the required compressed Yarn state file, so the package contents are not fully resolved.
Evidence
dist/contract/index.jsdist/utils/constants.js.yarn/install-state.gz
Network endpoints1
gateway.verified.network/api/sponsor
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines a library entrypoint and has no preinstall, install, or postinstall hook.
- The contract code sends an encrypted private key and transaction data to the configured Verified Network sponsorship service during explicit sponsorship calls.
- The required .yarn/install-state.gz file could not be read as printable UTF-8 source, so its contents could not be verified.
Evidence against
- The manifest lists ethers, tslib, and viem as runtime dependencies; it does not depend on itself.
- The inspected sponsorship endpoint is package-aligned, and the relevant requests occur inside called contract methods.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading source.yarn/install-state.gzView file
•path = .yarn/install-state.gz
kind = high_entropy_blob
sizeBytes = 226705
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = payload_in_excluded_dir
sizeBytes = 226705
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
.yarn/install-state.gzView on unpkg•path = .yarn/install-state.gz
kind = compressed_blob
sizeBytes = 226705
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
.yarn/install-state.gzView on unpkgdist/contract/index.js#virtual:normalized:round1
Findings
3 High3 Medium6 Low
HighShips High Entropy Blob.yarn/install-state.gz
HighPayload In Excluded Dir.yarn/install-state.gz
HighSemantic Analysis Limiteddist/contract/index.js#virtual:normalized:round1
MediumNetwork
MediumShips Compressed Blob.yarn/install-state.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/contract/index.js
LowAi Review Evidencedist/contract/index.js
Affected versions and remediation
This report applies to @verified-network/verified-sdk@2.9.7.
See all versions of @verified-network/verified-sdk for other recorded verdicts.
- Review the evidence and your use of @verified-network/verified-sdk@2.9.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.