registry / Telemetry / @connect-xyz/withdraw-react / 0.54.11

@connect-xyz/withdraw-react@0.54.11

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The wrapper automatically sends runtime failure telemetry containing page origin, browser user agent, and application context to a vendor collector. This is suspicious undisclosed telemetry; the inspected report builder does not include the JWT itself.

Static reason

No blocking static signals were detected.

Trigger

The React widget is mounted and its hosted script fails to load, including on a network error or timeout.

Impact

The collector receives visitor and application metadata without a documented telemetry disclosure or opt-out in the package README.

Mechanism

The wrapper builds a failure report and POSTs JSON to a configured Grafana Faro collector. The report includes browser user agent, page origin, app and script details, and selected parsed JWT claims; the JWT itself is not included in the inspected report builder.

AI rationale

Evidence

dist/index.js

Network endpoints5

grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The failure-report payload includes the visitor's browser user agent and page origin.
On a widget load failure, the code creates a report containing app, script, and parsed JWT-claim context.
The report is sent as a JSON POST to a configured Grafana Faro collector.
The collector URLs are hard-coded for the package's dev, cert, production, and EU environments.

Evidence against

The package is a React wrapper for the Connect Withdraw widget; loading its hosted widget script is consistent with that purpose.
The report path is tied to widget load failures, and the inspected code does not send the JWT itself.
The package metadata declares no lifecycle scripts.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.65 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk.connect.xyz, sdk.sandbox.connect.xyz

Source & flagged code

4 flagged

dist/index.jsView file

159e.env }, session: { id: n, attributes: i }, browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: wi

Medium

Ai Review Evidence

The failure-report payload includes the visitor's browser user agent and page origin.

dist/index.jsView on unpkg · L159

205l = { webComponentTag: t, appName: n, env: s, scriptUrl: r, reason: e, triedFallback: i, elapsedMs: o, claims: _ }; v(l); let u = i ? void 0 : m(a ??

Medium

Ai Review Evidence

On a widget load failure, the code creates a report containing app, script, and parsed JWT-claim context.

dist/index.jsView on unpkg · L205

183of fetch > "u") return; let { sessionId: r, payload: i } = v(t, n); try { fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i

Medium

Ai Review Evidence

The report is sent as a JSON POST to a configured Grafana Faro collector.

dist/index.js

Findings

5 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

LowUrl Strings

Affected versions and remediation

This report applies to @connect-xyz/withdraw-react@0.54.11.

See all versions of @connect-xyz/withdraw-react for other recorded verdicts.

Review the evidence and your use of @connect-xyz/withdraw-react@0.54.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 23:18:45.736Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @connect-xyz/withdraw-react / 0.54.11

@connect-xyz/withdraw-react@0.54.11

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The React widget is mounted and its hosted script fails to load, including on a network error or timeout.

Impact

The collector receives visitor and application metadata without a documented telemetry disclosure or opt-out in the package README.

Mechanism

AI rationale

Evidence

dist/index.js

Network endpoints5

grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The failure-report payload includes the visitor's browser user agent and page origin.
On a widget load failure, the code creates a report containing app, script, and parsed JWT-claim context.
The report is sent as a JSON POST to a configured Grafana Faro collector.
The collector URLs are hard-coded for the package's dev, cert, production, and EU environments.

Evidence against

The package is a React wrapper for the Connect Withdraw widget; loading its hosted widget script is consistent with that purpose.
The report path is tied to widget load failures, and the inspected code does not send the JWT itself.
The package metadata declares no lifecycle scripts.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

dist/index.jsView file

159e.env }, session: { id: n, attributes: i }, browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: wi

Medium

Ai Review Evidence

The failure-report payload includes the visitor's browser user agent and page origin.

dist/index.jsView on unpkg · L159

205l = { webComponentTag: t, appName: n, env: s, scriptUrl: r, reason: e, triedFallback: i, elapsedMs: o, claims: _ }; v(l); let u = i ? void 0 : m(a ??

Medium

Ai Review Evidence

On a widget load failure, the code creates a report containing app, script, and parsed JWT-claim context.

dist/index.jsView on unpkg · L205

183of fetch > "u") return; let { sessionId: r, payload: i } = v(t, n); try { fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i

Medium

Ai Review Evidence

The report is sent as a JSON POST to a configured Grafana Faro collector.

dist/index.js

Findings

5 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

LowUrl Strings

Affected versions and remediation

This report applies to @connect-xyz/withdraw-react@0.54.11.

See all versions of @connect-xyz/withdraw-react for other recorded verdicts.

Review the evidence and your use of @connect-xyz/withdraw-react@0.54.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 23:18:45.736Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.