Summary
Togoder Security scanned the npm package @reown/appkit-polyfills@1.7.8 on Oct 4, 2026. An AI review of 1 source file produced 1 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 2
Import-time side effects
NPS-4A32F241ABC5
Top-level code executes immediately on import (module side effect), modifying the global window object. This behavior can be exploited in some supply chain attacks to alter environment assumptions of other modules, though here it appears benign.
Global scope pollution
NPS-1AC0F1383C09
The code unconditionally assigns Buffer, global, and process to the window object when a browser environment is detected. While common in polyfill shims, this mutates global state and could interfere with other libraries or mask native implementations. It does not directly exfiltrate data but modifies runtime environment.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/esm/index.js | medium | The module is a benign polyfill that assigns Node.js globals to window at import time, but it performs global scope pollution and import-time side effects that warrant caution. |
Frequently asked questions
Is @reown/appkit-polyfills safe to use?
No confirmed malware was found in @reown/appkit-polyfills@1.7.8, but the review flagged 1 medium, 1 low severity findings for risky patterns worth checking before you rely on it.
Does @reown/appkit-polyfills contain malware?
No malware was identified in @reown/appkit-polyfills@1.7.8 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @reown/appkit-polyfills checked?
Togoder Security downloaded the published npm package and had an AI model read its 1 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @reown/appkit-polyfills together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @reown/appkit-polyfills@1.7.8, cost nothing.