registry / @connect-xyz/withdraw-react / 0.54.4
@connect-xyz/withdraw-react@0.54.4
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Withdraw product.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package exposes a browser widget that loads Connect-hosted code and submits bounded load-failure telemetry to fixed Zerohash collectors. No malicious behavior was identified in the inspected package source.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Withdraw component in a browser.
Impact
This supports the widget’s loading and diagnostics; inspected source shows no credential harvesting or unrelated destination.
Mechanism
The component loads the script for its selected environment; failures trigger a POST containing app and browser context to a configured or built-in Zerohash collector.
AI rationale
The package exposes a browser widget that loads Connect-hosted code and submits bounded load-failure telemetry to fixed Zerohash collectors. No malicious behavior was identified in the inspected package source.
Network endpoints5
sdk.connect.xyz/withdraw-web/index.jssdk.sandbox.connect.xyz/withdraw-web/index.jsgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js and defines no lifecycle scripts.
- The component loads Connect-hosted SDK scripts when rendered.
- On load failures, it sends telemetry to fixed Zerohash collector endpoints.
- Telemetry contains app/session metadata, browser details, page origin, and script-load failure context.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and defines no lifecycle scripts.
package.jsonView on unpkg · L5dist/index.jsView file
219production: "https://sdk.connect.xyz/withdraw-web/index.js"
}, B = "connect-withdraw", Y = X, oe = ({
jwt: e,
env: t = "production",
theme: o,
Low
Ai Review Evidence
The component loads Connect-hosted SDK scripts when rendered.
dist/index.jsView on unpkg · L21953dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collector.zerohash.com
Low
Findings
1 Medium8 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/withdraw-react@0.54.4.
See all versions of @connect-xyz/withdraw-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/withdraw-react@0.54.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.