registry / Telemetry / @connect-xyz/withdraw-react

@connect-xyz/withdraw-react

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.

This report shows the evidence for @connect-xyz/withdraw-react@0.54.12. 0 of 19 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package performs runtime error reporting to the vendor’s collector without disclosing it in the README. The report includes browser and page details and selected JWT claims, which makes this suspicious telemetry rather than a clean result.

Static reason

No blocking static signals were detected.

Trigger

The Withdraw component is mounted and its hosted script fails to load or define the expected element.

Impact

The collector receives details about the user’s browser, page origin, and participant or platform context without disclosure in the README.

Mechanism

The error handler builds a report from app and error context, browser user agent, page origin, and selected decoded JWT claims, then POSTs it to a Grafana Faro collector.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints7

grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk.sandbox.connect.xyzsdk.connect.xyz

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

On a hosted script load failure, the component reports an error to a configured collector.
The report includes the browser user agent and page origin.
The report also includes participant, platform, and region values decoded from the supplied JWT.
The README does not disclose this runtime error reporting.

Evidence against

The manifest declares no lifecycle scripts; the package’s code runs its loader from the React component effect.
The hosted scripts come from Connect Withdraw’s sandbox and production hosts, consistent with the package’s stated purpose.
The report is limited to script loading failures and does not send the JWT itself.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.99 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu, sdk.connect.xyz, sdk.sandbox.connect.xyz

Source & flagged code

4 flagged

dist/index.jsView file

165browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: window.location.origin } : void 0 }, logs: [{ messag

Medium

Ai Review Evidence

The report includes the browser user agent and page origin.

dist/index.jsView on unpkg · L165

186fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i), keepalive: !0 }).catch(() => v

Medium

Ai Review Evidence

On a hosted script load failure, the component reports an error to a configured collector.

dist/index.jsView on unpkg · L186

215v(l); let u = i ? void 0 : m(a ?? {}, s, c); if (u && u !== r) { T(u, !0); return; } b = !0, C(), document.getElementById(f)?.remove(), d?.(l); }, T = (e, n) => {

Medium

Ai Review Evidence

On a hosted script load failure, the component reports an error to a configured collector.

dist/index.jsView on unpkg · L215

Findings

5 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

LowUrl Strings

Affected versions and remediation

This report applies to @connect-xyz/withdraw-react@0.54.12.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @connect-xyz/withdraw-react@0.54.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:23:24.749Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

19 known versions

0.54.12latestshownSuspiciousTelemetryWarnPublishedOct 30, 2026, 3:01 PM 0.54.11SuspiciousTelemetryWarnPublishedOct 27, 2026, 1:57 PM 0.54.9Clean—AllowPublishedOct 23, 2026, 7:33 PM 0.54.8Clean—AllowPublishedOct 22, 2026, 7:00 PM

registry / Telemetry / @connect-xyz/withdraw-react

@connect-xyz/withdraw-react

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.

This report shows the evidence for @connect-xyz/withdraw-react@0.54.12. 0 of 19 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The Withdraw component is mounted and its hosted script fails to load or define the expected element.

Impact

The collector receives details about the user’s browser, page origin, and participant or platform context without disclosure in the README.

Mechanism

The error handler builds a report from app and error context, browser user agent, page origin, and selected decoded JWT claims, then POSTs it to a Grafana Faro collector.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints7

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

On a hosted script load failure, the component reports an error to a configured collector.
The report includes the browser user agent and page origin.
The report also includes participant, platform, and region values decoded from the supplied JWT.
The README does not disclose this runtime error reporting.

Evidence against

The manifest declares no lifecycle scripts; the package’s code runs its loader from the React component effect.
The hosted scripts come from Connect Withdraw’s sandbox and production hosts, consistent with the package’s stated purpose.
The report is limited to script loading failures and does not send the JWT itself.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

dist/index.jsView file

165browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: window.location.origin } : void 0 }, logs: [{ messag

Medium

Ai Review Evidence

The report includes the browser user agent and page origin.

dist/index.jsView on unpkg · L165

186fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i), keepalive: !0 }).catch(() => v

Medium

Ai Review Evidence

On a hosted script load failure, the component reports an error to a configured collector.

dist/index.jsView on unpkg · L186

215v(l); let u = i ? void 0 : m(a ?? {}, s, c); if (u && u !== r) { T(u, !0); return; } b = !0, C(), document.getElementById(f)?.remove(), d?.(l); }, T = (e, n) => {

Medium

Ai Review Evidence

On a hosted script load failure, the component reports an error to a configured collector.

dist/index.jsView on unpkg · L215

Findings

5 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

LowUrl Strings

Affected versions and remediation

This report applies to @connect-xyz/withdraw-react@0.54.12.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @connect-xyz/withdraw-react@0.54.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:23:24.749Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

19 known versions