-
Notifications
You must be signed in to change notification settings - Fork 13
Open
Description
cosmos-signer seems to use a library cosmjs-types (and other imported library's in this repo) which are using protobufjs which is importing a library quire using eval instead of importing it normally.
| "cosmjs-types": "^0.5.0" |
Is another issue directly opened on the mentioned packages repo.
protobufjs/protobuf.js#1754
While the implementation of eval from protobufjs may not be too problematic security wise it's causing a warning on build time by rollup which could obfuscate another eval call that is introduced by another library (that could be a threat) when a user has also imported your package.
benkeen and davideberlein
Metadata
Metadata
Assignees
Labels
No labels
