registry / @connect-xyz/withdraw-react / 0.52.2
@connect-xyz/withdraw-react@0.52.2
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection shows a React wrapper that loads a named hosted withdrawal web component on render and reports load failures. It has no lifecycle hooks or local execution, persistence, credential harvesting, or destructive behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the exported Withdraw component in a browser.
Impact
The browser contacts Connect SDK hosts and, on a load failure, a Faro collector with limited browser and page-origin metadata.
Mechanism
User-invoked remote web-component loading with failure telemetry.
AI rationale
Static inspection shows a React wrapper that loads a named hosted withdrawal web component on render and reports load failures. It has no lifecycle hooks or local execution, persistence, credential harvesting, or destructive behavior.
Network endpoints7
sdk.sandbox.connect.xyzsdk.connect.xyzgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no lifecycle scripts; its only runtime entry is dist/index.js.
- When the Withdraw React component is rendered, it injects a module script from the package's Connect SDK hosts.
- On load failure it sends operational telemetry containing browser user agent, page origin, and script-load details to configured Faro collector hosts.
Evidence against
- No install-time execution, filesystem access, child-process use, eval-like execution, or environment-variable harvesting appears in the inspected source.
- The remote script loading is activated by rendering the exported Withdraw component and is consistent with a web-component wrapper.
- The telemetry payload does not include the supplied JWT; it only derives selected non-secret claims for metadata.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
Low
Suspicious Lifecycle Evidence
The package has no lifecycle scripts; its only runtime entry is dist/index.js.
package.jsonView on unpkg · L5dist/index.jsView file
175const l = document.createElement("script");
l.id = g, l.src = p, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
f || (customElements.get(t) ? (f = !0, _(), b?.()) : S("not-defined", p, h));
}, 0);
}, l.onerror = () => S("network", p, h), x = setTimeout(() => S("timeout", p, h), u), document.getElementById(g)?.remove(), document.head.appendChild(l);
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/withdraw-react@0.52.2.
See all versions of @connect-xyz/withdraw-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-react@0.52.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.