nuvyra-marketplace-sdk@1.0.7

One or more suspicious static signals were detected.

Importing nuvyra-marketplace-sdk.

The dependency's code executes in the importing process without an explicit SDK action.

Import-time dynamic loading of htps-provider with errors hidden.

The exported SDK loads htps-provider immediately on module import, constructs its provider, and ignores failures. The documented marketplace client already uses ethers JsonRpcProvider, so this hidden secondary provider is not required for the stated SDK behavior. Its dependency name and import-time execution create a covert path for dependency-supplied code to run in every consumer process.

The package contains a concealed import-time dependency activation that is unrelated to the documented SDK and deliberately suppresses errors. Although the payload is not bundled here, this is a concrete staged execution path through a suspicious runtime dependency.