registry / Telemetry / @connect-xyz/withdraw-js / 0.54.11

@connect-xyz/withdraw-js@0.54.11

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Withdraw product.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The SDK automatically sends runtime failure telemetry containing browser and application context and JWT-derived claims to its vendor’s collector, with no documented opt-out in the inspected public API. This is a warning-level telemetry concern; the report is limited to widget-load failures and does not include the raw JWT.

Static reason

No blocking static signals were detected.

Trigger

The application calls Withdraw.render() and the widget script fails to load.

Impact

The vendor collector receives client application context and partner or participant metadata without a documented opt-out in the inspected public API.

Mechanism

The loader builds a diagnostic payload and POSTs it as JSON to an environment-selected Faro collector. The payload includes page origin, browser user-agent, and decoded JWT claims.

AI rationale

Evidence

dist/index.jsdist/index.d.ts

Network endpoints5

grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The loader reports through its callback when loading the widget script fails.
The report payload includes JWT-derived partner and participant claims, browser user-agent, and page origin.
It sends the report as a JSON POST with a Faro session ID header.
The configured collector endpoints are Zerohash Grafana Faro collectors.
A generated type comment mentions failure reporting to Faro with JWT claims, but the inspected public API shows no telemetry opt-out.

Evidence against

The report runs on widget script-load failure, after the application calls render().
The code decodes selected JWT claims; it does not send the raw JWT in the report.
The package manifest has no lifecycle scripts.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 19.1 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk.connect.xyz, sdk.sandbox.connect.xyz

Source & flagged code

7 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

227reports failures to Faro (with JWT claims for // partner/participant context) and removes a failed tag so a later // render() call can retry cleanly. this.scriptLoadingPromi

Medium

Ai Review Evidence

A generated type comment mentions failure reporting to Faro with JWT claims, but the inspected public API shows no telemetry opt-out.

dist/index.d.tsView on unpkg · L227

dist/index.jsView file

104y(s); let c = a ? void 0 : i(u ?? {}, f, p); if (c && c !== r) { T(c, !0); return; } b = !0, C(), document.getElementById(_)?.remove(), g?.(s); }

Findings

1 High7 Medium1 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

MediumAi Review Evidencedist/index.js

MediumAi Review Evidencedist/index.d.ts

LowUrl Strings

Affected versions and remediation

This report applies to @connect-xyz/withdraw-js@0.54.11.

See all versions of @connect-xyz/withdraw-js for other recorded verdicts.

Review the evidence and your use of @connect-xyz/withdraw-js@0.54.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 23:23:01.083Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @connect-xyz/withdraw-js / 0.54.11

@connect-xyz/withdraw-js@0.54.11

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Withdraw product.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The application calls Withdraw.render() and the widget script fails to load.

Impact

The vendor collector receives client application context and partner or participant metadata without a documented opt-out in the inspected public API.

Mechanism

The loader builds a diagnostic payload and POSTs it as JSON to an environment-selected Faro collector. The payload includes page origin, browser user-agent, and decoded JWT claims.

AI rationale

Evidence

dist/index.jsdist/index.d.ts

Network endpoints5

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The loader reports through its callback when loading the widget script fails.
The report payload includes JWT-derived partner and participant claims, browser user-agent, and page origin.
It sends the report as a JSON POST with a Faro session ID header.
The configured collector endpoints are Zerohash Grafana Faro collectors.
A generated type comment mentions failure reporting to Faro with JWT claims, but the inspected public API shows no telemetry opt-out.

Evidence against

The report runs on widget script-load failure, after the application calls render().
The code decodes selected JWT claims; it does not send the raw JWT in the report.
The package manifest has no lifecycle scripts.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

227reports failures to Faro (with JWT claims for // partner/participant context) and removes a failed tag so a later // render() call can retry cleanly. this.scriptLoadingPromi

Medium

Ai Review Evidence

A generated type comment mentions failure reporting to Faro with JWT claims, but the inspected public API shows no telemetry opt-out.

dist/index.d.tsView on unpkg · L227

dist/index.jsView file

104y(s); let c = a ? void 0 : i(u ?? {}, f, p); if (c && c !== r) { T(c, !0); return; } b = !0, C(), document.getElementById(_)?.remove(), g?.(s); }

Findings

1 High7 Medium1 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

MediumAi Review Evidencedist/index.js

MediumAi Review Evidencedist/index.d.ts

LowUrl Strings

Affected versions and remediation

This report applies to @connect-xyz/withdraw-js@0.54.11.

See all versions of @connect-xyz/withdraw-js for other recorded verdicts.

Review the evidence and your use of @connect-xyz/withdraw-js@0.54.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 23:23:01.083Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.