Summary
Togoder Security scanned the npm package @reown/appkit-common@1.7.8 on Oct 4, 2026. An AI review of 17 source files produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Sensitive Data Storage in localStorage
NPS-FDD51DDFF444
The code defines keys for storing authentication tokens (SIWX_AUTH_TOKEN, SIWX_NONCE_TOKEN) and wallet connection details in localStorage. While localStorage is a common client-side storage mechanism, storing authentication tokens in localStorage is generally discouraged because it is accessible to any JavaScript running on the same origin, making it vulnerable to XSS attacks. This is a security best-practice concern, not evidence of malicious intent.
Potential Information Exposure
NPS-97E3D0F15704
The SafeLocalStorage.clear() method calls localStorage.clear(), which removes all data for the origin, not just the keys defined in SafeLocalStorageKeys. If this library is used alongside other applications, this could unintentionally delete unrelated data. This is a design concern, not a malicious pattern.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/esm/src/utils/SafeLocalStorage.js | medium | No malicious patterns detected; the code provides safe localStorage wrappers but stores sensitive authentication tokens in localStorage, which is a security best-practice concern. |
| dist/esm/index.js | safe | The file only contains static ES module re-exports of utility functions and constants from local paths, with no executable code, network activity, obfuscation, or other malicious patterns. |
| dist/esm/src/contracts/erc20.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/contracts/swap.js | safe | This file only exports a static ABI definition for an ERC-20 approve function and contains no executable code, network activity, or other malicious patterns. |
| dist/esm/src/contracts/usdt.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/ConstantsUtil.js | safe | No malicious patterns detected; the file only contains static constants and a safe environment-variable lookup for a public origin URL, with no exfiltration, code execution, or filesystem/process manipulation. |
| dist/esm/src/utils/ContractUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/DateUtil.js | safe | No malicious patterns detected; the file only contains date formatting logic using the dayjs library without any exfiltration, credential harvesting, obfuscation, or dynamic execution. |
| dist/esm/src/utils/EmitterUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/InputUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/NamesUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/NavigationUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/NetworkUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/NumberUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/ParseUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/ThemeUtil.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/esm/src/utils/TypeUtil.js | safe | No malicious patterns detected |
Scanned versions of @reown/appkit-common
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 1.7.8 | Needs review | 17 | Oct 4, 2026 |
Frequently asked questions
Is @reown/appkit-common safe to use?
No confirmed malware was found in @reown/appkit-common@1.7.8, but the review flagged 1 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does @reown/appkit-common contain malware?
No malware was identified in @reown/appkit-common@1.7.8 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @reown/appkit-common checked?
Togoder Security downloaded the published npm package and had an AI model read its 17 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @reown/appkit-common together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @reown/appkit-common@1.7.8, cost nothing.