# @safe-global/safe-gateway-typescript-sdk@3.23.1 security report (npm)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-04T16:16:28.000Z
- Files reviewed: 22
- Findings: 2 medium, 1 low severity findings
- Report: https://security.togoder.click/npm/@safe-global/safe-gateway-typescript-sdk
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package @safe-global/safe-gateway-typescript-sdk@3.23.1 on Oct 4, 2026. An AI review of 22 source files produced 2 medium, 1 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Potential SSRF / unrestricted URL fetching

Finding ID: `NPS-2856B6279CAF`

File: `dist/utils.js:57`

fetchData and getData accept arbitrary urls and perform fetch calls, potentially allowing requests to internal services if the url is attacker-controlled.

### [medium] Credential forwarding

Finding ID: `NPS-5299A224E786`

File: `dist/utils.js:75`

credentials parameter is passed directly to fetch options, which may include cookies/auth headers for cross-origin requests; no validation on target origin.

### [low] Dynamic RegExp construction

Finding ID: `NPS-60E0F5D0F92E`

File: `dist/utils.js:30`

replaceParam builds a RegExp from a key parameter without escaping, which could cause errors or regex injection if keys contain special characters.

## Files reviewed

- `dist/utils.js` (medium): The utility functions appear benign but allow arbitrary network requests and credential forwarding, with minor regex handling concerns; no malicious patterns such as exfiltration or code execution were found.
- `dist/config.js` (safe): No malicious patterns detected
- `dist/endpoint.js` (safe): No malicious patterns detected; the code implements straightforward HTTP endpoint wrappers using utility functions with no signs of exfiltration, credential harvesting, obfuscation, or process spawning.
- `dist/index.js` (safe): No malicious patterns detected; the code is a legitimate Safe API client with standard HTTP endpoint wrappers.
- `dist/types/accounts.js` (safe): No malicious patterns detected
- `dist/types/api.js` (safe): No malicious patterns detected
- `dist/types/auth.js` (safe): The file contains only standard TypeScript/JavaScript export boilerplate and a source map reference with no executable or malicious logic.
- `dist/types/chains.js` (safe): No malicious patterns detected; the file only defines TypeScript enums for RPC authentication, gas price types, and feature flags with no executable or network-related code.
- `dist/types/common.js` (safe): No malicious patterns detected
- `dist/types/contracts.js` (safe): No malicious patterns detected
- `dist/types/decoded-data.js` (safe): No malicious patterns detected
- `dist/types/delegates.js` (safe): No malicious patterns detected
- `dist/types/emails.js` (safe): No malicious patterns detected
- `dist/types/human-description.js` (safe): No malicious patterns detected
- `dist/types/master-copies.js` (safe): The file contains only standard TypeScript/JavaScript module boilerplate and a source map reference, with no malicious patterns detected.
- `dist/types/notifications.js` (safe): No malicious patterns detected
- `dist/types/recovery.js` (safe): No malicious patterns detected
- `dist/types/relay.js` (safe): No malicious patterns detected
- `dist/types/safe-apps.js` (safe): No malicious patterns detected
- `dist/types/safe-info.js` (safe): No malicious patterns detected
- `dist/types/safe-messages.js` (safe): No malicious patterns detected
- `dist/types/transactions.js` (safe): No malicious patterns detected

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology