# @reown/appkit-polyfills@1.7.8 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:14:56.000Z
- Files reviewed: 1
- Findings: 1 medium, 1 low severity findings
- Report: https://security.togoder.click/npm/@reown/appkit-polyfills
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @reown/appkit-polyfills@1.7.8 on Oct 4, 2026. An AI review of 1 source file produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Import-time side effects

Finding ID: `NPS-4A32F241ABC5`

File: `dist/esm/index.js:2`

Top-level code executes immediately on import (module side effect), modifying the global window object. This behavior can be exploited in some supply chain attacks to alter environment assumptions of other modules, though here it appears benign.

### [low] Global scope pollution

Finding ID: `NPS-1AC0F1383C09`

File: `dist/esm/index.js:2`

The code unconditionally assigns Buffer, global, and process to the window object when a browser environment is detected. While common in polyfill shims, this mutates global state and could interfere with other libraries or mask native implementations. It does not directly exfiltrate data but modifies runtime environment.

## Files reviewed

- `dist/esm/index.js` (medium): The module is a benign polyfill that assigns Node.js globals to window at import time, but it performs global scope pollution and import-time side effects that warrant caution.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology