Summary
Togoder Security scanned the npm package @metamask/utils@12.0.0 on Oct 4, 2026. An AI review of 27 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/assert.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/base64.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/bytes.js | safe | No malicious patterns detected; this is a legitimate byte/hex/base64 conversion utility module with no network, filesystem, process, or dynamic code execution behavior. |
| dist/caip-types.js | safe | No malicious patterns detected; the file contains only CAIP identifier regex validators and pure utility functions with no network, filesystem, process, or dynamic code execution. |
| dist/checksum.js | safe | No malicious patterns detected |
| dist/coercers.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/collections.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/encryption-types.js | safe | This file is a TypeScript-generated empty export with a source map reference and contains no executable or malicious code. |
| dist/errors.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/fs.js | safe | The code is a standard file system utility module (read/write/remove/temp sandbox) with no network access, credential harvesting, obfuscation, dynamic code execution, or process spawning beyond normal Node.js filesystem operations. |
| dist/hashing.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/hex.js | safe | No malicious patterns detected; the file contains standard Ethereum hex/address validation and checksum utilities with no exfiltration, dynamic execution, or process spawning. |
| dist/index.js | safe | No malicious patterns detected in the re-export barrel file; all exports reference local modules and no execution, network, or exfiltration logic is present. |
| dist/json.js | safe | No malicious patterns detected; the code is a legitimate JSON/JSON-RPC validation utility from MetaMask. |
| dist/keyring.js | safe | The file contains only an empty export statement and a source map reference, with no executable or malicious code. |
| dist/logging.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/misc.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/mnemonic.js | safe | The code performs standard BIP-39 mnemonic conversion using the official MetaMask scure-bip39 wordlist, with no network, filesystem, process, or obfuscated activity detected. |
| dist/node.js | safe | No malicious patterns detected; the file only re-exports modules from local files. |
| dist/number.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/opaque.js | safe | No malicious patterns detected |
| dist/promise.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/superstruct.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/time.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/transaction-types.js | safe | No malicious patterns detected |
Show 2 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/unitsConversion.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/versions.js | safe | No malicious patterns detected |
Affected version ranges
None of the 5 scanned versions of @metamask/utils are flagged high or critical. The latest scanned version, 12.0.0, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 12.0.0 | No issues | 1 | 12.0.0 | |
| 11.11.0 – 11.12.1 | Not scanned | 2 | >=11.11.0 <=11.12.1 | |
| 8.5.0 – 11.8.1 | Needs review | 3 | >=8.5.0 <=11.8.1 | file system manipulation |
| 5.0.2 | No issues | 1 | 5.0.2 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of @metamask/utils
Frequently asked questions
Is @metamask/utils safe to use?
Our AI source review of @metamask/utils@12.0.0 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does @metamask/utils contain malware?
No malware was identified in @metamask/utils@12.0.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @metamask/utils checked?
Togoder Security downloaded the published npm package and had an AI model read its 27 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @metamask/utils together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @metamask/utils@12.0.0, cost nothing.