registry / @connect-xyz/withdraw-react / 0.52.0
@connect-xyz/withdraw-react@0.52.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a React wrapper that deliberately loads its vendor's withdrawal component at render time. Its network and dynamic-script behavior is product-aligned, user-invoked, and lacks an install-time or stealthy malicious chain.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Withdraw React component.
Impact
The rendered widget trusts code served by the configured Connect hosts; no package-side credential theft, filesystem mutation, or install-time execution was found.
Mechanism
Dynamic loading of a fixed vendor web-component module with failure telemetry.
AI rationale
This is a React wrapper that deliberately loads its vendor's withdrawal component at render time. Its network and dynamic-script behavior is product-aligned, user-invoked, and lacks an install-time or stealthy malicious chain.
Network endpoints7
sdk.connect.xyzsdk.sandbox.connect.xyzgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.zerohash.eugrafana-faro-collector.cert.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a normal ES-module entry point and contains no lifecycle scripts.
- Rendering Withdraw injects an environment-selected remote module script.
- On script-load failure, it sends limited diagnostic telemetry to a configured collector.
Evidence against
- Remote script URLs are fixed to Connect sandbox and production hosts.
- The component only activates this behavior when the consumer renders Withdraw.
- The telemetry payload derives JWT claims and includes browser/origin diagnostics, not the raw JWT.
- No file access, shell execution, install hook, persistence, or dependency installation is present.
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
Low
Suspicious Lifecycle Evidence
The manifest exposes a normal ES-module entry point and contains no lifecycle scripts.
package.jsonView on unpkg · L5dist/index.jsView file
173}, E = (p, h) => {
_(), C = performance.now();
const l = document.createElement("script");
l.id = g, l.src = p, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
f || (customElements.get(t) ? (f = !0, _(), b?.()) : S("not-defined", p, h));
}, 0);
}, l.onerror = () => S("network", p, h), x = setTimeout(() => S("timeout", p, h), u), document.getElementById(g)?.remove(), document.head.appendChild(l);
}, O = L(n, a, i);
return O ? (E(O, !1), () => {
f = !0, _();
}) : v;
Findings
1 High1 Medium4 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/withdraw-react@0.52.0.
See all versions of @connect-xyz/withdraw-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-react@0.52.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.