@connect-xyz/withdraw-js@0.54.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends runtime failure telemetry to its collector, including selected JWT claims and browser and page context. The behavior is documented, but no way to disable it was evident, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- The SDK documentation says the shared loader reports failures to Faro with JWT claims for partner and participant context.
- On a loader failure, the package POSTs a JSON diagnostic payload to a Faro collector endpoint.
- The diagnostic payload includes participant and platform claims, browser user agent, and the page origin.
- Reporting occurs in the widget script-loading failure path, not automatically at package import or install.
- The source decodes selected JWT claims for the report; the request body does not include the raw JWT.
- The declaration file documents the Faro reporting behavior.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe SDK documentation says the shared loader reports failures to Faro with JWT claims for partner and participant context.
dist/index.d.tsView on unpkg · L227Findings
Affected versions and remediation
This report applies to @connect-xyz/withdraw-js@0.54.12.
See all versions of @connect-xyz/withdraw-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-js@0.54.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.