@reown/appkit-controllers npm package: is it safe?

The open() method conditionally logs longMessage to console.error when debug mode is enabled. If longMessage contains sensitive user or application data, this could expose information in logs. However, this is a standard debugging pattern, not direct exfiltration.

The code checks if longMessage is a function and invokes it if so. While this is typical for lazy message generation, invoking untrusted callables could be risky if the message source is externally controlled.

The analytics base URL is obtained at module load time via CoreHelperUtil.getAnalyticsUrl() and used to construct a FetchUtil client. If that utility can be influenced by runtime configuration or environment, event data could be redirected to an attacker-controlled endpoint.

Module-level initialization creates a proxy state, instantiates a FetchUtil client, and captures Date.now(). While no network call fires at import, the module is immediately wired to send events when OptionsController features.analytics is enabled, so importing this module is not side-effect free.

The setSelectedProvider method constructs a URL with query parameters (publicKey, destinationCurrencyCode, walletAddress, externalCustomerId) from internal state and appends them to a third-party provider's URL. This is expected behavior for an on-ramp controller integrating with Meld, but it does share the wallet address and project ID with an external service. No credentials or environment variables are harvested.

A FetchUtil instance is constructed at module load time with a base URL derived from CoreHelperUtil.getAnalyticsUrl(). This sets up external communication infrastructure at import time, though the actual network request is deferred until sendError is invoked.

The code reads process.env['NEXT_PUBLIC_SECURE_SITE_ORIGIN'] at import time. Although this specific variable is benign, dynamically reading environment variables from a third-party package can be abused to exfiltrate sensitive configuration or tokens if combined with network calls elsewhere in the package.

The default SECURE_SITE points to 'https://secure.walletconnect.org', and subsequent constants build URLs from it. If this value is overridden via an environment variable, any consumer of this package could be redirected to an attacker-controlled origin. No validation is performed on the provided URL.

RESTRICTED_TIMEZONES includes several Asian timezones (Shanghai, Hong Kong, etc.). This is a feature-related list but could be used for region-based behavior differences; harmless by itself but worth noting for transparency.

copyToClopboard writes text to the clipboard. This is a normal utility function, but clipboard writes should only occur on explicit user action.

openHref and returnOpenHref call window.open with user-influenced href values. The default features string includes 'noreferrer noopener' and getOpenTargetForPlatform restricts targets, so risk is low, but opening arbitrary URLs could be abused for phishing if callers pass untrusted input.

getUUID falls back to Math.random-based v4 UUID generation when crypto.randomUUID is unavailable. Math.random is not cryptographically secure; if used for security-sensitive identifiers this could be a weakness.

formatTelegramSocialLoginUrl and injectIntoUrl manipulate URLs by injecting the current page href encoded into a 'state' parameter. This is intended for social login flows but could enable open redirect or state injection if the URL argument is attacker-controlled.

The code sends telemetry events such as 'SIWX_AUTH_SUCCESS', 'SIWX_AUTH_ERROR', and 'CLICK_CANCEL_SIWX' via EventsController. This is standard analytics behavior but constitutes outbound reporting of authentication outcomes and network/account metadata. This is not clearly malicious, but it is notable data transmission.

Multiple catch blocks log errors to console, potentially including authentication or session-related error details. This is not malicious but could expose sensitive details in logs.

The code creates SIWX authentication messages, requests wallet signatures via ConnectionController, and stores sessions including signatures. While expected for a Sign-In With X (SIWX) authentication utility, it interacts with sensitive wallet signing flows and stores auth sessions. Any bug here could impact authentication integrity, but no exfiltration or key theft patterns are present.

The code constructs and opens URLs to an external origin (ConstantsUtil.SECURE_SITE_SDK_ORIGIN) for social login popups. While this is likely a legitimate part of the appkit library for authentication, it does involve sending users to external sites and passing redirect URIs, which could be exploited if the origin is not trusted or if URIs are manipulated.

The code uses setTimeout with a callback that throws an error. While not eval or function constructor, it schedules code execution. However, this is a common pattern and not inherently malicious.

The custom error constructor captures and preserves original error stack traces and messages, which may contain sensitive data (file paths, tokens, internal identifiers), and these are then forwarded to the telemetry controller for transmission.