All @metamask/sdk-communication-layer versions
@metamask/sdk-communication-layer @0.33.0
Maintainers
Dependencies (6)
| Package | Constraint | Registry Status |
|---|---|---|
| uuid | ^8.3.2 | auto_approved |
| debug | ^4.3.4 | auto_approved |
| date-fns | ^2.29.3 | auto_approved |
| bufferutil | ^4.0.8 | auto_approved |
| utf-8-validate | ^5.0.2 | No greenflagged match |
| @metamask/sdk-analytics | 0.0.5 | auto_approved |
Dev Dependencies (47)
| Package | Constraint | Registry Status |
|---|---|---|
| jest | ^29.3.1 | auto_approved |
| eslint | ^7.30.0 | auto_approved |
| rimraf | ^3.0.2 | auto_approved |
| rollup | ^4.26.0 | auto_approved |
| eciesjs | ^0.4.11 | auto_approved |
| ts-jest | ^29.0.3 | auto_approved |
| ts-node | ^10.9.1 | auto_approved |
| prettier | ^2.3.0 | auto_approved |
| size-limit | ^11.1.6 | No greenflagged match |
| typescript | ^5.6.3 | auto_approved |
| @types/jest | ^29.2.4 | auto_approved |
| @types/node | ^20.1.3 | auto_approved |
| @types/uuid | ^9.0.0 | No greenflagged match |
| cross-fetch | ^4.0.0 | auto_approved |
| concurrently | ^9.1.2 | auto_approved |
| @jest/globals | ^29.3.1 | auto_approved |
| eventemitter2 | ^6.4.9 | auto_approved |
| socket.io-client | ^4.5.1 | auto_approved |
| stream-browserify | ^3.0.0 | auto_approved |
| eslint-plugin-jest | ^24.4.0 | No greenflagged match |
| eslint-plugin-node | ^11.1.0 | auto_approved |
| rollup-plugin-jscc | ^2.0.0 | Not imported |
| @rollup/plugin-json | ^6.0.0 | auto_approved |
| eslint-plugin-jsdoc | ^36.1.0 | auto_approved |
| rollup-plugin-sizes | ^1.0.6 | auto_approved |
| eslint-plugin-import | ^2.23.4 | auto_approved |
| @rollup/plugin-terser | ^0.4.4 | auto_approved |
| rollup-plugin-natives | ^0.7.5 | Not imported |
| @rollup/plugin-replace | ^6.0.1 | auto_approved |
| eslint-config-prettier | ^8.3.0 | auto_approved |
| eslint-plugin-prettier | ^3.4.0 | auto_approved |
| @lavamoat/allow-scripts | ^2.3.1 | No greenflagged match |
| @metamask/eslint-config | ^6.0.0 | No greenflagged match |
| @rollup/plugin-commonjs | ^25.0.0 | auto_approved |
| @metamask/auto-changelog | 3.1.0 | No greenflagged match |
| rollup-plugin-visualizer | ^5.12.0 | auto_approved |
| @typescript-eslint/parser | ^4.26.0 | auto_approved |
| rollup-plugin-typescript2 | ^0.31.2 | auto_approved |
| @size-limit/preset-big-lib | ^11.0.2 | Not imported |
| rollup-plugin-node-globals | ^1.4.0 | auto_approved |
| @rollup/plugin-node-resolve | ^15.0.2 | auto_approved |
| rollup-plugin-node-builtins | ^2.1.2 | auto_approved |
| rollup-plugin-polyfill-node | ^0.13.0 | auto_approved |
| @metamask/eslint-config-nodejs | ^6.0.0 | No greenflagged match |
| @typescript-eslint/eslint-plugin | ^4.26.0 | auto_approved |
| rollup-plugin-peer-deps-external | ^2.2.4 | No greenflagged match |
| @metamask/eslint-config-typescript | ^6.0.0 | No greenflagged match |
Transitive Dependency Tree
Risk Dispositions (1 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
osv:GHSA-qj3p-xc97-xw74 |
osv | reject | AI | AI (osv): Affected range >=0.16.0 <0.33.1; fix available in 0.33.1. Generalizes to all versions in this range. |
SAST Findings (2)
### Who is affected? This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of the following actions and then deployed their application: - Installed MetaMask SDK into a project with a lockfile for the first time - Installed MetaMask SDK in a project without a lockfile - Updated a lockfile to pull in `[email protected]` (e.g., via `npm update` or `yarn upgrade`) ### What happened? On Sept 8th, 2025 (13:00–15:30 UTC), a malicious version of the `debug` package (v4.4.2) was published to npm. The injected code attempts to interfere with dApp-to-wallet communication when executed in a browser context. While MetaMask SDK itself was not directly impacted, projects installing the SDK during this window may have inadvertently pulled in the malicious version of `debug`. ### Mitigation - If your application was rebuilt and redeployed after Sept 8th, 2025, 15:30 UTC, the malicious version of debug should no longer be present. Please also verify that your package manager (npm, yarn, pnpm, etc.) is not caching `[email protected]`. - If you have not yet deployed since performing one of the actions above, delete your `node_modules` and reinstall dependencies before deploying. - If your application was deployed during the attack window and has not been rebuilt since, perform a clean install of dependencies and redeploy to ensure the malicious package is removed. ### Resources [GitHub Advisory for debug](https://github.com/advisories/GHSA-8mgj-vmr8-frr6)
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
Review Summary
Risk score: 16. Findings: 1 medium (+10), 2 low (+6), 3 info (+0).
Commit: e1764d4a5c7c Browse source
Published to npm: