# @walletconnect/core@2.25.0 security report (npm) - Verdict: **Needs review** (risk level: medium) - Scanned: 2026-10-04T21:17:38.000Z - Files reviewed: 2 - Findings: 3 medium, 7 low severity findings - Report: https://security.togoder.click/npm/@walletconnect/core - Source: Togoder Security (https://security.togoder.click), AI source-code review ## Summary Togoder Security scanned the npm package @walletconnect/core@2.25.0 on Oct 4, 2026. An AI review of 2 source files produced 3 medium, 7 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware. ## Findings ### [medium] Telemetry data exfiltration to external server Finding ID: `NPS-7DB234715C71` File: `dist/index.cjs` The EventClient class (Ge) collects telemetry data including client ID, user agent, and pairing traces, then sends it to https://pulse.walletconnect.org/batch. While this is documented behavior for WalletConnect, it represents automatic exfiltration of device/session metadata to an external server on init. ### [medium] Automatic network requests at initialization Finding ID: `NPS-3341647B8F14` File: `dist/index.cjs` The EventClient.init() method automatically sends an 'INIT' event with the client ID, user agent, and app domain to the pulse.walletconnect.org telemetry endpoint when telemetryEnabled is true (default). ### [medium] Cryptographic key handling Finding ID: `NPS-F1D295403492` File: `dist/index.js` The code manages cryptographic keys (client seed, symmetric keys) and stores them in keychain/storage. This is expected for WalletConnect but could be a concern if keys are exfiltrated. The code does not appear to send keys to external servers except as part of normal protocol operations. ### [low] Credential/identifier storage in global scope Finding ID: `NPS-A79A05712319` File: `dist/index.cjs` The Core class stores the client ID under WALLETCONNECT_CLIENT_ID key in storage and sets a global reference (_walletConnectCore_) on globalThis, which persists sensitive session identifiers globally. Also accesses process.env.DISABLE_GLOBAL_CORE but this is benign config reading. ### [low] Dynamic iframe creation and postMessage listener Finding ID: `NPS-E66EB7FBCB44` File: `dist/index.cjs` The Verify class creates hidden iframes loading from verify.walletconnect.com and listens for postMessage events, then parses and validates JWTs. This is legitimate attestation flow but involves dynamic DOM manipulation and message handling that warrants review. ### [low] Global window function injection Finding ID: `NPS-5462E583B1F5` File: `dist/index.cjs` The Core constructor conditionally assigns window.downloadLogsBlobInBrowser, exposing a global function that can dump logs including client ID. This modifies the global window object outside package scope. ### [low] External network requests Finding ID: `NPS-C9460621A347` File: `dist/index.js` The code sends telemetry and event data to external WalletConnect servers (pulse.walletconnect.org, echo.walletconnect.com, verify.walletconnect.com) including client ID, user agent, project ID, and app domain. This is expected behavior for the WalletConnect SDK but constitutes data exfiltration to third-party servers. ### [low] Global state manipulation Finding ID: `NPS-1648463902FC` File: `dist/index.js` The code reads and writes to globalThis to store/retrieve a singleton Core instance, which could allow state manipulation or leakage between modules. ### [low] Environment variable access Finding ID: `NPS-D61297DE60DE` File: `dist/index.js` The code checks process.env.DISABLE_GLOBAL_CORE to disable global core functionality. This is a benign configuration check. ### [low] Dynamic code execution Finding ID: `NPS-B10A1826FDFC` File: `dist/index.js` The code uses setTimeout with string arguments (e.g., setTimeout(()=>{...}, delay)) which is safe, but also uses new Function indirectly? No, no eval or new Function detected. However, it does use dynamic import? No dynamic imports with computed paths. The code is a standard bundled SDK. ## Files reviewed - `dist/index.cjs` (medium): This is the legitimate WalletConnect Core v2.25.0 library that includes intentional telemetry to pulse.walletconnect.org, global state mutation, and dynamic network/iframe interactions—expected for a wallet relay SDK but worth noting for privacy-conscious deployments. - `dist/index.js` (medium): This is the official WalletConnect Core SDK, which performs expected network communication and key management; no overt malicious patterns were found, but it does exfiltrate telemetry data to WalletConnect servers. ## Version ranges None of the 3 scanned versions of @walletconnect/core are flagged high or critical. The latest scanned version, 2.25.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered. - 2.21.0 – 2.25.0 (`>=2.21.0 <=2.25.0`): medium (Telemetry and data collection +4 more) - 2.19.0 – 2.19.1 (`>=2.19.0 <=2.19.1`): not scanned ## Scanned versions - [2.25.0](https://security.togoder.click/npm/@walletconnect/core@2.25.0): medium, 2026-10-04T21:17:38.000Z - [2.21.1](https://security.togoder.click/npm/@walletconnect/core@2.21.1): medium, 2026-10-04T16:54:44.000Z - [2.21.0](https://security.togoder.click/npm/@walletconnect/core@2.21.0): medium, 2026-10-04T16:54:41.000Z AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology