@reown/appkit npm package: is it safe?

Empty import statement import {} from '@reown/appkit-controllers'; is unusual and may be used to trigger side effects in the module without importing any bindings. Combined with the package being a third-party crypto wallet library, this warrants scrutiny for hidden behavior.

Exported mutable variable modal is undefined initially and can be set by createAppKit. While not inherently malicious, this creates a singleton pattern that could be exploited if the module is later tampered with. The createAppKit function instantiates AppKit with user-provided options and a hardcoded sdkVersion, which is normal for such libraries.

modal?.switchNetwork(network) silently fails if modal is not initialized. This is a design choice, not a security flaw, but could hide errors. No direct malicious intent detected.

No dynamic imports or computed module loading are present.

The module initializes a mutable modal variable and uses top-level logic but no actual execution; however, the createAppKit function creates an AppKit instance and calls getAppKit(modal), which could have side effects when invoked. Importing this module alone does not execute createAppKit, but consumers calling it could trigger network or state changes.

The module-level modal variable may be shared across imports, leading to unexpected singleton behavior. This is not malicious but can cause security-relevant side effects if not intended.

The class extends AppKitBaseClient and imports controllers (ConnectionController, ConnectorController, AccountController) from '@reown/appkit-controllers'. This is a wallet-connection library. Wallet-related packages are common targets for supply-chain tampering (wallet drainers). No direct key/seed phrase handling or address rewriting is visible in this file, but the sink for wallet interactions exists here.

The injectModalUi method performs dynamic imports of '@reown/appkit-scaffold-ui/basic' and '@reown/appkit-scaffold-ui/w3m-modal'. While these are static string imports (not computed from user input), dynamic import() is a module loading mechanism that could be used to load arbitrary code if the package name or resolution is compromised/tampered with upstream. This is low risk here since the specifiers are hardcoded.

The injectModalUi method creates and inserts a custom element ('w3m-modal') into document.body at runtime. This is UI injection and could be abused if the injected element or associated scaffold-ui modules contain malicious behavior. Insertion is guarded by disableAppend/enableEmbedded options, which is reasonable, but the runtime DOM injection into the host page is worth noting.

loadModalComponents() dynamically imports multiple internal modules (embedded-wallet, email, socials, swaps, send, receive, onramp, transactions, pay) conditionally based on remoteFeatures sourced from a remote configuration server. While the import specifiers are static strings, the decision to load them is influenced by remote data, which could be abused if the remote config endpoint were compromised to control code loading behavior. This is a minor supply-chain/modularity concern rather than direct malicious behavior.

checkExistingTelegramSocialConnection() reads window.location.href search params (result_uri) and uses window.history.replaceState to strip it. This is standard OAuth/social login redirect handling, but it does process externally-controlled URL parameters and passes them as socialUri into ConnectionController.connectExternal, which can initiate an external wallet connection. Not inherently malicious but worth noting as a trust boundary.

The client pulls remoteFeatures (email, socials, swaps, onramp, activity, etc.) from a remote source and enables financial UI features based on them. If the remote feature endpoint were tampered with, it could alter which wallet operations are exposed. This is a design-level trust dependency rather than an exploit in this file.

The auth provider creates a W3mFrameProvider that communicates with an embedded modal/iframe to handle wallet operations, emails, and RPC requests. Interactions with an embedded wallet iframe can be a vector for XSS/data leakage if origin validation is weak; however no such validation logic is visible here and this appears to be the legitimate Reown AppKit auth flow.