@connect-xyz/withdraw-react@0.53.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the active entrypoint uses network access for widget loading and failure telemetry. Inspected telemetry sends selected metadata to package-defined collectors and does not send the JWT itself, so no concrete malicious behavior was established.
Decision evidence
public snapshot- package.json exposes dist/index.js as the package entrypoint and declares no lifecycle scripts.
- The entrypoint sends error telemetry only when script loading fails; the payload contains app, session, browser, page, and decoded JWT claim metadata, not the JWT itself.
- Default telemetry destinations are Zerohash collector endpoints; the withdrawal widget loads its configured environment script when rendered.
Source & flagged code
7 flaggedpackage.json exposes dist/index.js as the package entrypoint and declares no lifecycle scripts.
package.jsonView on unpkg · L5The entrypoint sends error telemetry only when script loading fails; the payload contains app, session, browser, page, and decoded JWT claim metadata, not the JWT itself.
dist/index.jsView on unpkg · L133Findings
Affected versions and remediation
This report applies to @connect-xyz/withdraw-react@0.53.0.
See all versions of @connect-xyz/withdraw-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-react@0.53.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.