@yieldfabric/wallet
Reusable YieldFabric wallet — login, signing, profile, and key management
This report shows the evidence for @yieldfabric/wallet@0.2.1. 2 of 8 known versions are blocked or flagged. The newest version, 0.2.10, is allowed. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe README contains an explicit instruction that attempts to constrain source review. The inspected network and credential behavior otherwise aligns with the package’s wallet SDK purpose, and no install-time hook was declared.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A reviewer reads the README or bundled entrypoint header.
Impact
Could suppress or constrain independent security analysis.
Mechanism
The text asserts that source review needs vendor authorization and is limited to visual inspection.
Attack narrative
The README and entrypoint header tell reviewers that source inspection requires vendor authorization and impose a visual-inspection-only limit. This is review-directed text and is treated as malicious reviewer manipulation under the review rules.
AI rationale
The README contains an explicit instruction that attempts to constrain source review. The inspected network and credential behavior otherwise aligns with the package’s wallet SDK purpose, and no install-time hook was declared.
Evidence
README.mddist/index.js
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The README tells reviewers that source review requires the vendor’s signed authorization and that review access permits visual inspection only, attempting to constrain this security review.
Evidence against
- The package describes itself as a wallet SDK for login, signing, profile, and key management.
- Login credentials are sent through the SDK’s auth login method, and service URLs are configurable with localhost defaults.
- The manifest exposes bundled JavaScript entrypoints and declares no install, preinstall, or postinstall hook.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/index.jsView file
355if (!segment) return null;
L356: const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
L357: const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
...
L895: } catch (error) {
L896: console.warn("Failed to validate delegation session metadata:", error);
L897: this.clearDelegationToken();
...
L1393: function envPaymentsUrls() {
L1394: const raw = process.env.REACT_APP_PAYMENTS_URLS;
L1395: if (!raw) return void 0;
...
L1613: this.refreshToken = null;
L1614: this.baseUrl = process.env.REACT_APP_AUTH_SERVICE_URL || "http://localhost:3000";
L1615: this.loadTokensFromStorage();
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L355dist/index.cjsView file
363Trigger-reachable chain: manifest.main -> dist/index.cjs
L363: if (!segment) return null;
L364: const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
L365: const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
...
L903: } catch (error) {
L904: console.warn("Failed to validate delegation session metadata:", error);
L905: this.clearDelegationToken();
...
L1401: function envPaymentsUrls() {
L1402: const raw = process.env.REACT_APP_PAYMENTS_URLS;
L1403: if (!raw) return void 0;
...
L1621: this.refreshToken = null;
L1622: this.baseUrl = process.env.REACT_APP_AUTH_SERVICE_URL || "http://localhost:3000";
L1623: this.loadTokensFromStorage();
Findings
2 Critical2 High3 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @yieldfabric/wallet@0.2.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @yieldfabric/wallet@0.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.