registry / @xrpl-wallet-kit/browser / 0.1.17
@xrpl-wallet-kit/browser@0.1.17
Browser-ready XRPL Wallet Kit bundle for vanilla JavaScript and legacy HTML sites.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found the flagged network and token handling in wallet authentication and XRPL RPC flows, with the OAuth token sent to the matching Xumm service. The manifest has no install lifecycle hook, and no concrete malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or invoking the browser wallet kit features that make these requests.
Impact
No unrelated credential disclosure or other concrete attack impact was established.
Mechanism
The OAuth flow exchanges a redirect response for an access token and sends it to the Xumm user-info endpoint; account-status checks use the configured XRPL RPC URL.
AI rationale
Source inspection found the flagged network and token handling in wallet authentication and XRPL RPC flows, with the OAuth token sent to the matching Xumm service. The manifest has no install lifecycle hook, and no concrete malicious behavior was identified.
Evidence
package.jsondist/xrpl-wallet-kit.iife.js
Network endpoints1
oauth2.xumm.app/userinfo
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes the inspected browser bundle as its default entrypoint and has no install lifecycle hook.
- The bundle sends an OAuth access token to the Xumm user-info service and sends ordinary account-status requests to the configured XRPL RPC URL.
Evidence against
- The inspected credential use is directed to the matching Xumm OAuth service; no unrelated credential recipient or concrete attack behavior was identified.
Behavioral surface
CryptoNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/xrpl-wallet-kit.iife.jsView file
1/*! @xrpl-wallet-kit/browser v0.1.17 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.write(string2, encoding);
L399: if (actual !== length) {
...
L4857: const
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/xrpl-wallet-kit.iife.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/xrpl-wallet-kit.iife.js
L1: /*! @xrpl-wallet-kit/browser v0.1.17 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.wri
Findings
2 Critical2 High2 Medium6 Low
CriticalCredential Exfiltrationdist/xrpl-wallet-kit.iife.js
CriticalTrigger Reachable Dangerous Capabilitydist/xrpl-wallet-kit.iife.js
HighTrigger Reachable Credential Exfiltrationdist/xrpl-wallet-kit.iife.js
HighSemantic Analysis Limiteddist/xrpl-wallet-kit.iife.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
Affected versions and remediation
This report applies to @xrpl-wallet-kit/browser@0.1.17.
See all versions of @xrpl-wallet-kit/browser for other recorded verdicts.
- Review the evidence and your use of @xrpl-wallet-kit/browser@0.1.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.