registry / @xrpl-wallet-kit/browser / 0.1.13
@xrpl-wallet-kit/browser@0.1.13
Browser-ready XRPL Wallet Kit bundle for vanilla JavaScript and legacy HTML sites.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged token flow uses Xumm’s own OAuth endpoints in a browser wallet integration. The scanner’s credential-exfiltration and protestware leads were not confirmed in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the browser bundle exposes wallet-kit behavior; OAuth and name-resolution requests occur when the related features are used.
Impact
No unrelated credential collection, unsolicited account action, or other attack behavior was identified in the reviewed paths.
Mechanism
The inspected token flow uses Xumm’s OAuth endpoints and sends its access token to Xumm’s userinfo endpoint.
AI rationale
The manifest has no install hook, and the flagged token flow uses Xumm’s own OAuth endpoints in a browser wallet integration. The scanner’s credential-exfiltration and protestware leads were not confirmed in the inspected source.
Network endpoints2
oauth2.xumm.appapp.xrpdomains.xyz
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no preinstall, install, or postinstall hook; its only script builds the package.
- The module entry re-exports wallet-kit client functionality, matching the package’s stated browser-wallet purpose.
- The flagged Xumm token flow uses Xumm’s own OAuth endpoints and requests the XummPkce scope.
- The bundle’s Xumm userinfo request sends the access token to oauth2.xumm.app, its own OAuth service.
Evidence against
- The static scanner reported credential-exfiltration and protestware patterns in the bundle, but the inspected token flow does not send credentials to an unrelated host.
- The package’s other observed network calls support expected wallet functionality, including XRPL name resolution.
Behavioral surface
ChildProcessCryptoNetworkWebSocket
HighEntropyStringsMinifiedProtestwareUrlStrings
Source & flagged code
6 flaggeddist/xrpl-wallet-kit.iife.jsView file
1/*! @xrpl-wallet-kit/browser v0.1.13 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.write(string2, encoding);
L399: if (actual !== length) {
...
L4810: const
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/xrpl-wallet-kit.iife.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/xrpl-wallet-kit.iife.js
L1: /*! @xrpl-wallet-kit/browser v0.1.13 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.wri
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/xrpl-wallet-kit.iife.js
CriticalTrigger Reachable Dangerous Capabilitydist/xrpl-wallet-kit.iife.js
HighTrigger Reachable Credential Exfiltrationdist/xrpl-wallet-kit.iife.js
HighSemantic Analysis Limiteddist/xrpl-wallet-kit.iife.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @xrpl-wallet-kit/browser@0.1.13.
See all versions of @xrpl-wallet-kit/browser for other recorded verdicts.
- Review the evidence and your use of @xrpl-wallet-kit/browser@0.1.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.