Chore/trezor vendor sync v26.7.4

[ByteZhang1024]

No description provided.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​bignumber.js@​11.1.5

View full report

[originalix]

Automated code review found blocking issues

@ByteZhang1024

Reviewed commit 5311691511af. This report always reflects the latest reviewed changes.

Review summary

This PR vendors the Trezor transport-common and browser layers, refreshes protobuf and protocol definitions, adds streamed Trezor device-authenticity verification, and adds Ledger genuine-check relay configuration while updating package wiring and examples.

What needs attention: Remove the newly introduced uncontrolled network and logging paths, then rerun browser, transport, and package validation.

Issues to address

• P1 · WebUSB initialization allows an arbitrary sessions-background fetch
  • Impact: sessionsBackgroundUrl is caller-controlled and init() issues a fetch to it without origin or path validation. This expands the SDK's outbound network surface and permits arbitrary hosts to receive client requests during transport startup.
  • Suggested action: Restrict the URL to the same-origin generated worker asset (or a tightly defined allowlist), reject external origins, and use credentials omission for the asset probe.
• P1 · Protocol errors log raw transport payload bytes
  • Impact: When decoding fails, the new transport utility writes the first response buffer as hexadecimal to console.warn. Device responses can contain transaction/signing material and other sensitive protocol data, so malformed input or device errors can expose it in browser or application logs.
  • Suggested action: Remove the payload dump and log only non-sensitive metadata such as message type, length, and error code.
• P1 · Ledger genuine-check adds an unapproved outbound WebSocket path
  • Impact: Calling getDeviceGenuineCheck constructs Ledger's DMK action, which opens the documented wss://scriptrunner.api.live.ledger.com/update/genuine backend by default. This is a new external network path carrying an attestation transcript and device metadata outside the repository's approved network surface.
  • Suggested action: Route the operation through a validated OneKey-owned relay or obtain an explicit network-policy exception with enforced endpoint and data-flow controls before exposing this API.

Validation gaps

The focused package build could not run because the workspace lacks the tsup executable (/bin/sh: tsup: command not found). Browser bundling, transport integration, and real-device attestation paths therefore still need to be validated after dependencies are installed.