feat(snap-network-utils): add shared AssetsProvider (WPN-1784) by ulissesferreira · Pull Request #82 · MetaMask/internal-snaps

ulissesferreira · 2026-07-31T12:52:43Z

Summary

Add AssetsProvider to @metamask/snap-networks-utils as a thin, typed read layer over Core AssetsController
Bump @metamask/assets-controller to ^13.0.0 and wire messenger actions for getAccountAssetByID, getAccountAssetsByIDs, and getAccountAssetsByScope
Export AssetsProvider, AssetsProviderMessenger, and ASSETS_PROVIDER_NAME from the package root
Sync bitcoin and tron snap.manifest.json bundle shasums after lockfile changes

Test plan

yarn workspace @metamask/snap-networks-utils run build
yarn workspace @metamask/snap-networks-utils run test
yarn constraints

socket-security · 2026-07-31T12:52:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@metamask/assets-controller@13.0.0

View full report

socket-security · 2026-07-31T12:52:55Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

npm/@metamask/assets-controller@13.0.0
npm/@ethersproject/providers@5.8.0
npm/@metamask/assets-controllers@110.0.3
npm/@metamask/config-registry-controller@2.0.0
npm/@metamask/core-backend@8.1.0
npm/@metamask/network-controller@35.0.0
npm/@metamask/phishing-controller@17.3.0
npm/@metamask/remote-feature-flag-controller@5.0.0
npm/@metamask/transaction-controller@69.4.0
npm/@metamask/profile-sync-controller@28.3.0
npm/@tanstack/query-core@5.101.4
npm/ethereumjs-wallet@1.0.2
npm/ulid@2.4.0
npm/@metamask/eth-json-rpc-infura@10.3.0
npm/@metamask/geolocation-controller@1.0.0
npm/@metamask/multichain-network-controller@3.2.2
npm/keccak@3.0.4
npm/rlp@2.2.7
npm/ws@8.18.0
npm/@metamask/snaps-controllers@19.0.1

View full report

ulissesferreira · 2026-07-31T12:59:37Z

@SocketSecurity ignore npm/shiki@0.14.7
Transitive via typedoc (devDependency only, docs/build tooling).
"Obfuscated" alert is minified highlighter + TextMate grammars.
Network/fetch is for loading onig.wasm and local theme/grammar assets.
Same version already ignored in MetaMask/eth-json-rpc-middleware#426; also present in MetaMask/core via typedoc.

ulissesferreira · 2026-07-31T12:59:38Z

@SocketSecurity ignore npm/vscode-oniguruma@1.7.0
Transitive via typedoc → shiki (devDependency only).
fetch is Emscripten WASM bootstrap (same-origin).
Publisher change alexandrudima → vscode-bot is Microsoft maintainers on microsoft/vscode-oniguruma.
Same version ignored in MetaMask/eth-json-rpc-middleware#426; also in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:40Z

@SocketSecurity ignore npm/cjs-module-lexer@1.4.3
Transitive via @ts-bridge/cli (build tooling only; not in published dist).
Official nodejs/cjs-module-lexer; installed sources use JSON.parse, not eval.
Already present in this repo via Jest as a different major.

ulissesferreira · 2026-07-31T12:59:41Z

@SocketSecurity ignore npm/marked@4.3.0
Transitive via typedoc (docs tooling only; not in published dist).
AI alert is about markdown URL sanitization; only used for typedoc HTML docs.
Same typedoc→marked@4.3.0 stack already in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:49Z

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.
Same package already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:50Z

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:51Z

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:51Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.0.2
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-07-31T12:59:52Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:53Z

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/snap-networks-utils published output; already present across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:54Z

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:54Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@1.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:54Z

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/snap-networks-utils published output; already present across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:55Z

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:55Z

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:56Z

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack.
Standard keccak native addon used across MetaMask/core for address/hash operations.

ulissesferreira · 2026-07-31T12:59:56Z

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:57Z

@SocketSecurity ignore npm/@metamask/core-backend@8.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:57Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

ulissesferreira · 2026-07-31T12:59:57Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T12:59:58Z

@SocketSecurity ignore npm/rlp@2.2.7
Transitive via @metamask/assets-controller. Standard RLP encoding library in MetaMask/core dependency tree.
Publisher change holgerd77 → ralxz is ethereumjs org maintainer rotation.

ulissesferreira · 2026-07-31T12:59:59Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T13:00:00Z

@SocketSecurity ignore npm/ulid@2.4.0
Transitive via @metamask/assets-controller. Standard ULID generator used by MetaMask controllers.
Publisher change alizain → perrymitchell is routine npm maintainer handoff on the ulid package.

ulissesferreira · 2026-07-31T13:00:01Z

@SocketSecurity ignore npm/ws@8.18.0
Transitive via @metamask/assets-controller. Standard WebSocket library used by MetaMask controller dependency tree.
AI anomaly is generic EventTarget-style event dispatch; already present across MetaMask/core.

ulissesferreira · 2026-07-31T13:00:15Z

@SocketSecurity ignore npm/shiki@0.14.7
Transitive via typedoc (devDependency only, docs/build tooling).
"Obfuscated" alert is minified highlighter + TextMate grammars.
Network/fetch is for loading onig.wasm and local theme/grammar assets.
Same version already ignored in MetaMask/eth-json-rpc-middleware#426; also present in MetaMask/core via typedoc.

ulissesferreira · 2026-07-31T13:00:17Z

@SocketSecurity ignore npm/vscode-oniguruma@1.7.0
Transitive via typedoc → shiki (devDependency only).
fetch is Emscripten WASM bootstrap (same-origin).
Publisher change alexandrudima → vscode-bot is Microsoft maintainers on microsoft/vscode-oniguruma.
Same version ignored in MetaMask/eth-json-rpc-middleware#426; also in MetaMask/core.

## Explanation  Proposal to simplify `AssetsService` types and returned values, to align it to what's currently returned by AssetsController's actions. ## References  Related to #82 ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/internal-snaps/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/internal-snaps/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

ulissesferreira · 2026-07-31T19:13:03Z

@SocketSecurity ignore npm/@metamask/assets-controller@13.0.0
Direct dependency for Core AssetsController messenger action types; published dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:03Z

@SocketSecurity ignore npm/@metamask/assets-controllers@110.0.3
Transitive via @metamask/assets-controller@13.0.0 (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

ulissesferreira · 2026-07-31T19:13:03Z

@SocketSecurity ignore npm/@metamask/config-registry-controller@2.0.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:04Z

@SocketSecurity ignore npm/@metamask/core-backend@8.1.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:10Z

@SocketSecurity ignore npm/@metamask/geolocation-controller@1.0.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:11Z

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.2
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:13Z

@SocketSecurity ignore npm/@metamask/network-controller@35.0.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:14Z

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@5.0.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T19:13:15Z

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0
Transitive via @metamask/assets-controller@13.0.0 (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

ulissesferreira · 2026-07-31T21:54:56Z

@metamaskbot publish-preview

github-actions · 2026-07-31T21:57:21Z

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/bitcoin-wallet-snap@2.0.0-preview-8589132
@metamask-previews/snap-networks-utils@0.0.0-preview-8589132
@metamask-previews/tron-wallet-snap@2.0.0-preview-8589132

ulissesferreira mentioned this pull request Jul 31, 2026

feat: add shared AssetsService to snap-networks-utils #80

Closed

4 tasks

ulissesferreira added a commit that referenced this pull request Jul 31, 2026

chore: link AssetsService changelog entry to PR #82

04cc577

mikesposito reviewed Jul 31, 2026

View reviewed changes

Comment thread packages/snap-networks-utils/src/services/assets/AssetsService.ts Outdated

mikesposito mentioned this pull request Jul 31, 2026

refactor: simplify AssetsService types #84

Merged

4 tasks

mikesposito reviewed Jul 31, 2026

View reviewed changes

Comment thread packages/snap-networks-utils/src/types/core-messenger.ts Outdated

MetaMask deleted a comment from cursor Bot Jul 31, 2026

ulissesferreira force-pushed the WPN-1784-shared-assets-service branch 2 times, most recently from 80f3343 to 0d6b38b Compare July 31, 2026 20:16

ulissesferreira added the no-changelog label Jul 31, 2026

ulissesferreira force-pushed the WPN-1784-shared-assets-service branch 3 times, most recently from 76d9473 to f4e8722 Compare July 31, 2026 20:29

feat(snap-network-utils): add shared AssetsProvider

8589132

ulissesferreira force-pushed the WPN-1784-shared-assets-service branch from 8747d44 to 8589132 Compare July 31, 2026 21:24

ulissesferreira changed the title ~~feat: add shared AssetsService to snap-networks-utils (WPN-1784)~~ feat(snap-network-utils): add shared AssetsProvider (WPN-1784) Jul 31, 2026

ulissesferreira assigned ulissesferreira and unassigned ulissesferreira Jul 31, 2026

ulissesferreira marked this pull request as ready for review July 31, 2026 21:25

ulissesferreira temporarily deployed to default-branch July 31, 2026 21:25 — with GitHub Actions Inactive

Uh oh!

Conversation

ulissesferreira commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

Uh oh!

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

Uh oh!

ulissesferreira commented Jul 31, 2026

ulissesferreira commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading