registry / @connect-xyz/withdraw-react / 0.54.0
@connect-xyz/withdraw-react@0.54.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe inspected entrypoint performs package-aligned widget loading and failure reporting, with no install hook or confirmed credential exfiltration. Mark clean.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Withdraw component; telemetry is sent if loading fails.
Impact
Expected widget loading and diagnostics; no concrete malicious behavior was established.
Mechanism
The component loads a Connect XYZ-hosted script and posts app and failure metadata to a collector endpoint. The inspected payload does not include the JWT itself.
AI rationale
The inspected entrypoint performs package-aligned widget loading and failure reporting, with no install hook or confirmed credential exfiltration. Mark clean.
Network endpoints7
sdk.sandbox.connect.xyzsdk.connect.xyzgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this package and points its entrypoints to dist/index.js; it declares no lifecycle scripts.
- The exported Withdraw component loads the Connect XYZ sandbox or production widget script when rendered.
- On script-load failure, the bundle posts error telemetry to the selected collector; the payload contains app, session, browser, page, and failure context.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
2"name": "@connect-xyz/withdraw-react",
"version": "0.54.0",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./di
Low
Suspicious Lifecycle Evidence
The manifest identifies this package and points its entrypoints to dist/index.js; it declares no lifecycle scripts.
package.jsonView on unpkg · L2dist/index.jsView file
217}, X = {
sandbox: "https://sdk.sandbox.connect.xyz/withdraw-web/index.js",
production: "https://sdk.connect.xyz/withdraw-web/index.js"
}, B = "connect-withdraw", Y = X, oe = ({
jwt: e,
env: t = "production",
th
Low
Ai Review Evidence
The exported Withdraw component loads the Connect XYZ sandbox or production widget script when rendered.
dist/index.jsView on unpkg · L217102}, G = (e, t) => {
const o = K(), r = globalThis.__ZH_WEB_SDK_VERSION__, n = {};
e.claims.participantCode && (n.participant_code = e.claims.participantCode), e.claims.platformName && (n.platform_name = e.claims.platformName), e.claims.platformCode && (n.platform_code = e.claims.platformCode), e.claims.region && (n.region = e
Findings
1 Medium5 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/withdraw-react@0.54.0.
See all versions of @connect-xyz/withdraw-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-react@0.54.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.