@connect-xyz/withdraw-js@0.54.9
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest has no install hook, and the runtime network activity is tied to consumer-invoked widget rendering and failure diagnostics sent to the package’s Connect-related endpoints. The diagnostic request contains contextual data and JWT-derived claims, but the inspected request body does not send the raw JWT or establish an attack.
Decision evidence
public snapshot- The manifest points to the browser SDK entrypoint and declares no install lifecycle scripts.
- The declaration file requires a JWT and exposes rendering as an SDK operation.
- Rendering loads a hosted Connect widget; the declared production script URL belongs to the package’s Connect integration.
- On script-load failure, the SDK sends diagnostic data to its environment’s Faro collector, including browser and page context and JWT-derived claims; the request body does not include the raw JWT.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declaration file requires a JWT and exposes rendering as an SDK operation.
dist/index.d.tsView on unpkg · L30The declaration file requires a JWT and exposes rendering as an SDK operation.
dist/index.d.tsView on unpkg · L90Findings
Affected versions and remediation
This report applies to @connect-xyz/withdraw-js@0.54.9.
See all versions of @connect-xyz/withdraw-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-js@0.54.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.