# @reown/appkit-common@1.7.8 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:09:20.000Z
- Files reviewed: 17
- Findings: 1 medium, 1 low severity findings
- Report: https://security.togoder.click/npm/@reown/appkit-common
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @reown/appkit-common@1.7.8 on Oct 4, 2026. An AI review of 17 source files produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Sensitive Data Storage in localStorage

Finding ID: `NPS-FDD51DDFF444`

File: `dist/esm/src/utils/SafeLocalStorage.js`

The code defines keys for storing authentication tokens (SIWX_AUTH_TOKEN, SIWX_NONCE_TOKEN) and wallet connection details in localStorage. While localStorage is a common client-side storage mechanism, storing authentication tokens in localStorage is generally discouraged because it is accessible to any JavaScript running on the same origin, making it vulnerable to XSS attacks. This is a security best-practice concern, not evidence of malicious intent.

### [low] Potential Information Exposure

Finding ID: `NPS-97E3D0F15704`

File: `dist/esm/src/utils/SafeLocalStorage.js`

The SafeLocalStorage.clear() method calls localStorage.clear(), which removes all data for the origin, not just the keys defined in SafeLocalStorageKeys. If this library is used alongside other applications, this could unintentionally delete unrelated data. This is a design concern, not a malicious pattern.

## Files reviewed

- `dist/esm/src/utils/SafeLocalStorage.js` (medium): No malicious patterns detected; the code provides safe localStorage wrappers but stores sensitive authentication tokens in localStorage, which is a security best-practice concern.
- `dist/esm/index.js` (safe): The file only contains static ES module re-exports of utility functions and constants from local paths, with no executable code, network activity, obfuscation, or other malicious patterns.
- `dist/esm/src/contracts/erc20.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/contracts/swap.js` (safe): This file only exports a static ABI definition for an ERC-20 approve function and contains no executable code, network activity, or other malicious patterns.
- `dist/esm/src/contracts/usdt.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/ConstantsUtil.js` (safe): No malicious patterns detected; the file only contains static constants and a safe environment-variable lookup for a public origin URL, with no exfiltration, code execution, or filesystem/process manipulation.
- `dist/esm/src/utils/ContractUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/DateUtil.js` (safe): No malicious patterns detected; the file only contains date formatting logic using the dayjs library without any exfiltration, credential harvesting, obfuscation, or dynamic execution.
- `dist/esm/src/utils/EmitterUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/InputUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/NamesUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/NavigationUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/NetworkUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/NumberUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/ParseUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/ThemeUtil.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/esm/src/utils/TypeUtil.js` (safe): No malicious patterns detected

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology