registry / @xrpl-wallet-kit/browser / 0.1.20
@xrpl-wallet-kit/browser@0.1.20
Browser-ready XRPL Wallet Kit bundle for vanilla JavaScript and legacy HTML sites.
AI Security Review
scanned 18d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The scanner's credential warning is explained by an OAuth token sent to Xumm's own userinfo endpoint, while the inspected WalletConnect traffic is package-aligned.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the package exposes the wallet kit; OAuth and WalletConnect requests occur during their corresponding authentication or connection flows.
Impact
The inspected flows support the package's wallet and authentication functions; no unrelated credential recipient or other confirmed attack behavior was found.
Mechanism
The inspected code sends an OAuth access token to Xumm's userinfo service, registers a supplied WalletConnect device token, and sends SDK event data when telemetry is enabled.
AI rationale
Source inspection found no concrete attack behavior. The scanner's credential warning is explained by an OAuth token sent to Xumm's own userinfo endpoint, while the inspected WalletConnect traffic is package-aligned.
Evidence
package.jsondist/xrpl-wallet-kit.iife.jsdist/xrpl-wallet-kit.iife.min.js
Network endpoints3
oauth2.xumm.apppulse.walletconnect.orgbkcode.vip
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- The manifest exposes the reviewed bundles and lists only a build script; it has no install lifecycle hook.
- The bundle exchanges an authorization code through a configured OAuth token endpoint and sends the resulting bearer token to Xumm's userinfo service.
- WalletConnect device-token registration posts a caller-provided token to a project-specific endpoint.
- WalletConnect telemetry submissions are gated by telemetryEnabled and go to the WalletConnect pulse endpoint.
- The bkcode.vip URL appears in WalletConnect wallet-link configuration, not as a credential collection endpoint.
Evidence against
- The scanner flags credential exfiltration, but inspected token flow is an OAuth userinfo request to oauth2.xumm.app; no unrelated recipient was found.
Behavioral surface
CryptoNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/xrpl-wallet-kit.iife.jsView file
1/*! @xrpl-wallet-kit/browser v0.1.20 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.write(string2, encoding);
L399: if (actual !== length) {
...
L5996: const
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/xrpl-wallet-kit.iife.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/xrpl-wallet-kit.iife.js
L1: /*! @xrpl-wallet-kit/browser v0.1.20 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.wri
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/xrpl-wallet-kit.iife.js
CriticalTrigger Reachable Dangerous Capabilitydist/xrpl-wallet-kit.iife.js
HighTrigger Reachable Credential Exfiltrationdist/xrpl-wallet-kit.iife.js
HighSemantic Analysis Limiteddist/xrpl-wallet-kit.iife.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumStripped Provenance Metadatadist/xrpl-wallet-kit.iife.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @xrpl-wallet-kit/browser@0.1.20.
See all versions of @xrpl-wallet-kit/browser for other recorded verdicts.
- Review the evidence and your use of @xrpl-wallet-kit/browser@0.1.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.