chore: tron integration into packages

[taran-a]

Explanation

Tron package updates

• Move files into packages/ folder.
• Fix lint errors, suppress the rest.
• Fix yarn constraints. (This requires attention as there are several major versions updates)
  @metamask/snaps-sdk: ^10.3.0 → 11.2.0 for all packages as we use this lib in resolutions in the root package.json.

Bitcoin package updates

• Fix yarn constraints. (This requires attention as there are several major versions updates)
  @metamask/keyring-api: ^22.0.0 → ^23.2.0 in bitcoin-wallet-snap.

References

• Related to WPN-1326

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ethers@​6.16.0 ⏵ 6.17.0	+5			-2
	@​metamask/​snaps-sdk@​11.1.1 ⏵ 11.2.0			+1	+4
	jest-it-up@​2.2.0
	tronweb@​6.1.0

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm asynckit is 75.0% likely to have a medium risk anomaly Notes: The analyzed code is a standard wrapper/adapter for long-signature iterators in a streaming context. It includes proper handling to avoid duplicate callbacks, emits errors correctly, and finalizes the stream appropriately. There is no indication of malicious behavior, data exfiltration, or backdoor-like mechanisms. The risk is minimal and primarily relates to correct usage by downstream code (e.g., ensuring stream object has the expected properties). Confidence: 0.75 Severity: 0.50 From: ? → npm/tronweb@6.1.0 → npm/asynckit@0.4.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/asynckit@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm delayed-stream is 69.0% likely to have a medium risk anomaly Notes: The DelayedStream module intercepts and buffers events from a source stream. While the core functionality appears to be for stream delay and management, two aspects raise concern: the overriding of the source's emit method and the attachment of a silent error handler (source.on('error', function() {})). The silent error handler is particularly suspicious as it can mask underlying problems or potential malicious activity originating from the source stream. Without further context on why errors are being suppressed, this behavior warrants caution. The code itself does not exhibit direct malware patterns like network exfiltration or reverse shells, but the error suppression could be a component of a larger, more covert operation. Confidence: 0.69 Severity: 0.50 From: ? → npm/tronweb@6.1.0 → npm/delayed-stream@1.0.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/delayed-stream@1.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ethers is 68.0% likely to have a medium risk anomaly Notes: The analyzed code fragment appears to be a conventional ABI interface utility (likely from a library like ethers.js) used to parse, encode, and decode Ethereum function calls, events, and errors. There is no evidence of malicious behavior such as data exfiltration, remote control, or code injection. Minor anomalies (typo in an error message and a partially commented/unfinished block) are present but do not constitute malicious activity. Overall security risk from this fragment is low, assuming it is used as intended within a trusted library context. Confidence: 0.68 Severity: 0.55 From: ? → npm/tronweb@6.1.0 → npm/ethers@6.13.5 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ethers@6.13.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm jest-it-up is 75.0% likely to have a medium risk anomaly Notes: The code functions as a simple utility to read a config and a local coverage report. The main security risk is dynamic requiring of an external module, which can execute arbitrary code if configPath is untrusted. If configPath is controlled by a trusted CI/project environment, risk is moderate. Recommend validating/isolating the config, adding error handling, and avoiding synchronous disk I/O when possible. Confidence: 0.75 Severity: 0.60 From: packages/tron-wallet-snap/package.json → npm/jest-it-up@2.2.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jest-it-up@2.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm semver is 77.0% likely to have a medium risk anomaly Notes: Conclusion: The code is a standard, benign implementation of a semver range-exterior check. No malicious behavior, no data exfiltration, and no suspicious side effects are evident. It operates purely on in-memory data and relies on local modules for comparisons. Overall security risk appears low. Confidence: 0.77 Severity: 0.60 From: ? → npm/tronweb@6.1.0 → npm/semver@7.7.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/semver@7.7.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm tronweb is 75.0% likely to have a medium risk anomaly Notes: The code fragment is a standard API client pattern for fetching event data from an external Tron-like event server. There is no evidence of backdoors or data exfiltration within this fragment. Primary concerns are insufficient input validation (particularly for limit, fingerprint, and blockNumber), lack of robust error handling (no catch), and potential misconfiguration of the external event server. Security risk is moderate due to network interactions and dependency on input integrity rather than explicit malicious activity. Confidence: 0.75 Severity: 0.60 From: packages/tron-wallet-snap/package.json → npm/tronweb@6.1.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tronweb@6.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm tronweb is 72.0% likely to have a medium risk anomaly Notes: The code implements a dynamic plugin system for TronWeb, capable of extending or replacing parts of the core API at runtime. The main security considerations are the risks inherent in any plugin ecosystem: plugins can execute arbitrary code, mutate core API surfaces, and override methods. While there are no hardcoded secrets or network actions in this fragment, the ability for plugins to modify TronWeb at runtime represents a potential security risk if untrusted plugins are loaded. To mitigate risk, enforce strong plugin provenance, implement sandboxed or restricted plugin interfaces, and tighten version gating (avoid permissive defaults). The code is not inherently malicious, but its safety heavily depends on the trustworthiness of plugins. Confidence: 0.72 Severity: 0.60 From: packages/tron-wallet-snap/package.json → npm/tronweb@6.1.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tronweb@6.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ws is 75.0% likely to have a medium risk anomaly Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation. Confidence: 0.75 Severity: 0.50 From: ? → npm/ethers@6.17.0 → npm/ws@8.21.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ws@8.21.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• axios@1.12.2
• validator@13.15.20
• follow-redirects@1.16.0
• form-data@4.0.6

View full report

[taran-a]

@SocketSecurity ignore npm/axios@1.12.2
├─ tronweb@npm:6.1.0
└─ axios@npm:1.12.2 (via npm:1.12.2)

(we use this lib in the original tron repo )

[taran-a]

@SocketSecurity ignore npm/validator@13.15.20
├─ tronweb@npm:6.1.0
└─ validator@npm:13.15.20 (via npm:13.15.20)

(we use this lib in the original tron repo)

[taran-a]

@SocketSecurity ignore npm/follow-redirects@1.16.0
└─ axios@npm:1.12.2
└─ follow-redirects@npm:1.15.9 [cdb8e] (via npm:^1.15.6 [cdb8e])

(we use this lib in the original tron repo but other version)

[taran-a]

@SocketSecurity ignore npm/form-data@4.0.6
└─ axios@npm:1.12.2
└─ form-data@npm:4.0.4 (via npm:^4.0.4)

(we use this lib in the original tron repo but other version)

[ulissesferreira]

For the Keyring API and Snaps SDK bump have you confirmed that building and loading the Snap on the extension yields no problems?