pluto-xlayer-pay@1.0.0
Pluto SDK for XLayer chain payment
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe bundle sends page and wallet identifying details to Reown's analytics endpoint during SDK initialization despite configuring analytics off, and the package provides no disclosure. This is suspicious runtime telemetry; the clipboard finding is ordinary user-triggered address pasting.
Decision evidence
public snapshot- The SDK initializes Reown AppKit and unconditionally emits an INITIALIZE event, even though its configuration sets analytics to false.
- Telemetry events include the browser page URL, hostname, connected wallet address, and active chain ID.
- Queued telemetry is sent to pulse.walletconnect.org at /batch.
- The clipboard read is bound to a visible Paste button and sets the text as the payment recipient address.
- The manifest has no install lifecycle hooks; its scripts are development, build, lint, and preview commands.
- The package is described as an XLayer payment SDK and exports wallet connection and payment methods.
Source & flagged code
5 flaggedSource appears to send environment or credential material to an external endpoint.
dist/pluto-sdk.jsView on unpkg · L1Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/pluto-sdk.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/pluto-sdk.jsView on unpkgFindings
Affected versions and remediation
This report applies to pluto-xlayer-pay@1.0.0.
See all versions of pluto-xlayer-pay for other recorded verdicts.
- Review the evidence and your use of pluto-xlayer-pay@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.