registry / @xrpl-wallet-kit/browser / 0.1.21
@xrpl-wallet-kit/browser@0.1.21
Browser-ready XRPL Wallet Kit bundle for vanilla JavaScript and legacy HTML sites.
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection found no malicious behavior. Scanner flags correspond to a caller-configurable XUMM API client and a Bitget Wallet connection link, while wallet transactions require a caller request and active adapter.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer creates the wallet kit and invokes a wallet operation; the package manifest has no install hook.
Impact
No unrelated credential disclosure or automatic account action was established.
Mechanism
The XUMM SDK sends credentials to its configured API endpoint, which defaults to XUMM; the endpoint setter requires an explicit call. The other unusual host is a Bitget Wallet connection link.
AI rationale
Source inspection found no malicious behavior. Scanner flags correspond to a caller-configurable XUMM API client and a Bitget Wallet connection link, while wallet transactions require a caller request and active adapter.
Evidence
package.jsondist/xrpl-wallet-kit.iife.jsdist/xrpl-wallet-kit.iife.min.js
Network endpoints2
xumm.appbkcode.vip/
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the browser bundle and lists only a build script, with no install lifecycle hook.
- The wallet kit constructs a client; transaction submission requires an active adapter and a caller request.
- The embedded XUMM SDK defaults to xumm.app and changes endpoint only through its explicit setter.
- The SDK sends XUMM API credentials to its configured API endpoint; no unrelated recipient is shown by the inspected flow.
- bkcode.vip appears as Bitget Wallet's WalletConnect universal link.
Evidence against
Behavioral surface
CryptoNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/xrpl-wallet-kit.iife.jsView file
1/*! @xrpl-wallet-kit/browser v0.1.21 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.write(string2, encoding);
L399: if (actual !== length) {
...
L6222: const
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/xrpl-wallet-kit.iife.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> dist/xrpl-wallet-kit.iife.js
L1: /*! @xrpl-wallet-kit/browser v0.1.21 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
L2: var __defProp = Object.defineProperty;
...
L8: var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
L9: var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
L10: var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member...
...
L61: var buffer = {};
L62: var base64Js = {};
L63: var hasRequiredBase64Js;
...
L397: let buf = createBuffer(length);
L398: const actual = buf.wri
Findings
2 Critical2 High2 Medium6 Low
CriticalCredential Exfiltrationdist/xrpl-wallet-kit.iife.js
CriticalTrigger Reachable Dangerous Capabilitydist/xrpl-wallet-kit.iife.js
HighTrigger Reachable Credential Exfiltrationdist/xrpl-wallet-kit.iife.js
HighSemantic Analysis Limiteddist/xrpl-wallet-kit.iife.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/xrpl-wallet-kit.iife.js
Affected versions and remediation
This report applies to @xrpl-wallet-kit/browser@0.1.21.
See all versions of @xrpl-wallet-kit/browser for other recorded verdicts.
- Review the evidence and your use of @xrpl-wallet-kit/browser@0.1.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.