registry / @xrpl-wallet-kit/browser / 0.1.19
@xrpl-wallet-kit/browser@0.1.19
Browser-ready XRPL Wallet Kit bundle for vanilla JavaScript and legacy HTML sites.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found package-aligned Xumm authentication: JWTs are sent to Xumm API and OAuth endpoints, and postMessage origins are checked. No unrelated credential exfiltration or other attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer uses the wallet authentication flow, with automatic restoration gated by its options.
Impact
No unrelated credential recipient or confirmed attack impact was established.
Mechanism
The bundle attaches a bearer token to Xumm API calls and sends an OAuth access token to Xumm's userinfo endpoint; it restricts accepted authentication messages to Xumm origins.
AI rationale
Source inspection found package-aligned Xumm authentication: JWTs are sent to Xumm API and OAuth endpoints, and postMessage origins are checked. No unrelated credential exfiltration or other attack behavior was established.
Evidence
dist/xrpl-wallet-kit.iife.js
Network endpoints3
oauth2.xumm.app/userinfoxumm.appoauth2.xumm.app
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the flagged bundle as the package entrypoint.
- The bundle sends bearer tokens to its fixed Xumm API endpoint and confines JWT requests to its listed API endpoints.
- The OAuth userinfo flow accepts messages only from Xumm origins and sends its token to Xumm's OAuth service.
- Automatic token restoration is conditional on caller options.
Evidence against
- The inspected credential use is part of the Xumm wallet authentication flow; no unrelated recipient or credential exfiltration was identified.
Behavioral surface
CryptoNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/xrpl-wallet-kit.iife.jsView file
1/*! @xrpl-wallet-kit/browser v0.1.19 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.write(string2, encoding);
L399: if (actual !== length) {
...
L5996: const
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/xrpl-wallet-kit.iife.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/xrpl-wallet-kit.iife.js
L1: /*! @xrpl-wallet-kit/browser v0.1.19 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.wri
Findings
2 Critical2 High2 Medium6 Low
CriticalCredential Exfiltrationdist/xrpl-wallet-kit.iife.js
CriticalTrigger Reachable Dangerous Capabilitydist/xrpl-wallet-kit.iife.js
HighTrigger Reachable Credential Exfiltrationdist/xrpl-wallet-kit.iife.js
HighSemantic Analysis Limiteddist/xrpl-wallet-kit.iife.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
Affected versions and remediation
This report applies to @xrpl-wallet-kit/browser@0.1.19.
See all versions of @xrpl-wallet-kit/browser for other recorded verdicts.
- Review the evidence and your use of @xrpl-wallet-kit/browser@0.1.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.