registry / @connect-xyz/withdraw-react / 0.52.3

@connect-xyz/withdraw-react@0.52.3

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The package entrypoint is a React withdrawal widget. Its network activity loads the configured Connect SDK and sends bounded failure diagnostics to the configured collectors; the inspected source shows no concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A consumer renders the Withdraw component; diagnostic reporting activates if its web component script fails to load.

Impact

The inspected code supports ordinary withdrawal-widget loading and failure telemetry; it does not establish credential theft or another attack.

Mechanism

The bundle loads the configured Connect SDK script and posts failure details, including browser and page metadata and selected JWT claims, to the configured collector.

AI rationale

Network endpoints7

sdk.connect.xyzsdk.sandbox.connect.xyzgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exports dist/index.js as the package entrypoint and declares no lifecycle scripts.
dist/index.js sends a diagnostic POST containing app, session, browser, page, and script-load failure details.
Diagnostics are sent only when a script-loading error occurs, through the supplied reporter or environment-specific collector URLs.
The component loads the Connect withdraw web component from the configured sandbox or production Connect SDK URL.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.68 KB of source, external domains: grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk.connect.xyz, sdk.sandbox.connect.xyz

Source & flagged code

5 flagged

package.jsonView file

1{ "name": "@connect-xyz/withdraw-react", "version": "0.52.3", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "exports": { "./package.json": "./package.json", ".": { "types": "

Low

Suspicious Lifecycle Evidence

package.json exports dist/index.js as the package entrypoint and declares no lifecycle scripts.

package.jsonView on unpkg · L1

dist/index.jsView file

121tried_fallback: String(e.triedFallback), elapsed_ms: String(e.elapsedMs) } } ] }; return { sessionId: o, payload: s }; }, Z = (e, t, o) => {

Low

Ai Review Evidence

dist/index.js sends a diagnostic POST containing app, session, browser, page, and script-load failure details.

dist/index.jsView on unpkg · L121

131t, o); try { fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(n), keepalive: !0 }).catch(() => {

Findings

1 Medium6 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @connect-xyz/withdraw-react@0.52.3.

See all versions of @connect-xyz/withdraw-react for other recorded verdicts.

Review the evidence and your use of @connect-xyz/withdraw-react@0.52.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 05:19:41.432Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @connect-xyz/withdraw-react / 0.52.3

@connect-xyz/withdraw-react@0.52.3

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A consumer renders the Withdraw component; diagnostic reporting activates if its web component script fails to load.

Impact

The inspected code supports ordinary withdrawal-widget loading and failure telemetry; it does not establish credential theft or another attack.

Mechanism

The bundle loads the configured Connect SDK script and posts failure details, including browser and page metadata and selected JWT claims, to the configured collector.

AI rationale

Network endpoints7

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exports dist/index.js as the package entrypoint and declares no lifecycle scripts.
dist/index.js sends a diagnostic POST containing app, session, browser, page, and script-load failure details.
Diagnostics are sent only when a script-loading error occurs, through the supplied reporter or environment-specific collector URLs.
The component loads the Connect withdraw web component from the configured sandbox or production Connect SDK URL.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

package.jsonView file

Low

Suspicious Lifecycle Evidence

package.json exports dist/index.js as the package entrypoint and declares no lifecycle scripts.

package.jsonView on unpkg · L1

dist/index.jsView file

121tried_fallback: String(e.triedFallback), elapsed_ms: String(e.elapsedMs) } } ] }; return { sessionId: o, payload: s }; }, Z = (e, t, o) => {

Low

Ai Review Evidence

dist/index.js sends a diagnostic POST containing app, session, browser, page, and script-load failure details.

dist/index.jsView on unpkg · L121

131t, o); try { fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(n), keepalive: !0 }).catch(() => {

Findings

1 Medium6 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @connect-xyz/withdraw-react@0.52.3.

See all versions of @connect-xyz/withdraw-react for other recorded verdicts.

Review the evidence and your use of @connect-xyz/withdraw-react@0.52.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 05:19:41.432Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.