Summary
Togoder Security scanned the npm package @walletconnect/utils@2.25.0 on Oct 4, 2026. An AI review of 2 source files produced 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.
Findings 3
Network request
NPS-B3A080E103A8
The code contains an EIP-1271 signature verification function that makes a POST request to an external RPC endpoint (default https://rpc.walletconnect.org/v1) using the global fetch API. This is a legitimate network call for blockchain interaction, not data exfiltration, but it does send user-provided signature data to an external server.
Dynamic code execution
NPS-820226249DEF
The code uses window.open with computed URLs for deeplink handling, which could be abused for open redirect if inputs are not properly validated. However, the URLs are constructed from trusted parameters and the function includes checks for same-origin and Telegram-specific handling.
Cryptographic operations
NPS-DC0B96EE2FA3
The file includes extensive cryptographic utilities (key generation, encryption/decryption, signature verification, hashing) for wallet connectivity. These are expected for a WalletConnect library and do not appear to be malicious, but they handle sensitive key material. No evidence of key exfiltration or address rewriting.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/index.cjs | medium | This appears to be a legitimate WalletConnect utility library with standard cryptographic and network operations, but it does make external network requests and handles sensitive cryptographic material, warranting caution. |
| dist/index.js | safe | This is the legitimate WalletConnect Core utility library containing only standard cryptographic helper functions, validation logic, and browser/environment detection; no malicious patterns such as data exfiltration, obfuscated payloads, dynamic code execution, or backdoor installation were detected. |
Affected version ranges
None of the 3 scanned versions of @walletconnect/utils are flagged high or critical. The latest scanned version, 2.25.0, is medium risk. Only versions we have scanned are listed; unscanned versions between them are not covered.
| Versions | Verdict | Count | Range | Top findings |
|---|---|---|---|---|
| 2.21.0 – 2.25.0 | Needs review | 3 | >=2.21.0 <=2.25.0 | suspicious network requests |
| 2.19.0 – 2.19.1 | Not scanned | 2 | >=2.19.0 <=2.19.1 |
Full list, including published versions not scanned yet: version ranges API.
Scanned versions of @walletconnect/utils
Frequently asked questions
Is @walletconnect/utils safe to use?
No confirmed malware was found in @walletconnect/utils@2.25.0, but the review flagged 3 low severity findings for risky patterns worth checking before you rely on it.
Does @walletconnect/utils contain malware?
No malware was identified in @walletconnect/utils@2.25.0 when Togoder Security scanned it on Oct 4, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was @walletconnect/utils checked?
Togoder Security downloaded the published npm package and had an AI model read its 2 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan @walletconnect/utils together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in @walletconnect/utils@2.25.0, cost nothing.