registry / @xrpl-wallet-kit/browser / 0.1.16
@xrpl-wallet-kit/browser@0.1.16
Browser-ready XRPL Wallet Kit bundle for vanilla JavaScript and legacy HTML sites.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe inspected bundle’s credential use is tied to wallet authentication and API calls, with no evidence of an unrelated recipient. The flagged domains are used for a wallet deep link and error documentation, so the source supports a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or using the browser wallet SDK triggers its package functions.
Impact
No confirmed malicious impact or unrelated credential disclosure was established.
Mechanism
Authentication tokens are sent through SDK requests to its configured API, and OAuth messages are checked against Xumm origins.
AI rationale
The inspected bundle’s credential use is tied to wallet authentication and API calls, with no evidence of an unrelated recipient. The flagged domains are used for a wallet deep link and error documentation, so the source supports a clean verdict.
Evidence
package.jsondist/xrpl-wallet-kit.iife.js
Network endpoints4
xumm.appoauth2.xumm.appbkcode.vip/oxlib.sh
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the IIFE bundle as the main entrypoint and has only a build script.
- The SDK sends its bearer token with requests to its configured API endpoint.
- The OAuth flow accepts messages only from the named Xumm origins.
- The flagged Bitget domain is used as a WalletConnect deep link, and the other unusual domain builds error documentation URLs.
Evidence against
- No source evidence showed a hidden credential recipient or unrelated credential forwarding.
- The examined network and storage behavior is consistent with wallet and authentication functions.
Behavioral surface
CryptoNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/xrpl-wallet-kit.iife.jsView file
1/*! @xrpl-wallet-kit/browser v0.1.16 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.write(string2, encoding);
L399: if (actual !== length) {
...
L4812: const
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/xrpl-wallet-kit.iife.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/xrpl-wallet-kit.iife.js
L1: /*! @xrpl-wallet-kit/browser v0.1.16 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.wri
Findings
2 Critical2 High2 Medium6 Low
CriticalCredential Exfiltrationdist/xrpl-wallet-kit.iife.js
CriticalTrigger Reachable Dangerous Capabilitydist/xrpl-wallet-kit.iife.js
HighTrigger Reachable Credential Exfiltrationdist/xrpl-wallet-kit.iife.js
HighSemantic Analysis Limiteddist/xrpl-wallet-kit.iife.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
Affected versions and remediation
This report applies to @xrpl-wallet-kit/browser@0.1.16.
See all versions of @xrpl-wallet-kit/browser for other recorded verdicts.
- Review the evidence and your use of @xrpl-wallet-kit/browser@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.