@connect-xyz/withdraw-react@0.54.12
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package performs runtime error reporting to the vendor’s collector without disclosing it in the README. The report includes browser and page details and selected JWT claims, which makes this suspicious telemetry rather than a clean result.
Decision evidence
public snapshot- On a hosted script load failure, the component reports an error to a configured collector.
- The report includes the browser user agent and page origin.
- The report also includes participant, platform, and region values decoded from the supplied JWT.
- The README does not disclose this runtime error reporting.
- The manifest declares no lifecycle scripts; the package’s code runs its loader from the React component effect.
- The hosted scripts come from Connect Withdraw’s sandbox and production hosts, consistent with the package’s stated purpose.
- The report is limited to script loading failures and does not send the JWT itself.
Source & flagged code
4 flaggedThe report includes the browser user agent and page origin.
dist/index.jsView on unpkg · L165On a hosted script load failure, the component reports an error to a configured collector.
dist/index.jsView on unpkg · L186On a hosted script load failure, the component reports an error to a configured collector.
dist/index.jsView on unpkg · L215Findings
Affected versions and remediation
This report applies to @connect-xyz/withdraw-react@0.54.12.
See all versions of @connect-xyz/withdraw-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-react@0.54.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.