@stitch-money/web@2.30.0
Pure Stitch SDK web components
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe Base64 strings are ad-block filter data, and the payment and fingerprint requests use Stitch service hosts. However, automatic runtime error logging sends the embedding site’s hostname or referrer to Stitch analytics without an evident disclosure or opt-out, so this is suspicious telemetry.
Static reason
One or more suspicious static signals were detected.
Trigger
An SDK operation encounters an error, such as fingerprint collection or configuration initialization.
Impact
The vendor receives identifying information about the site using the SDK along with operational error details.
Mechanism
The SDK sends a POST to analytics.stitch.money/query with the error and metadata, including a hostname derived from ancestor origins or document.referrer.
AI rationale
The Base64 strings are ad-block filter data, and the payment and fingerprint requests use Stitch service hosts. However, automatic runtime error logging sends the embedding site’s hostname or referrer to Stitch analytics without an evident disclosure or opt-out, so this is suspicious telemetry.
Evidence
device-data.js
Network endpoints7
analytics.stitch.moneypublic-config.stitch.moneypublic-config-staging.stitch.moneypublic-config-pre-prod.stitch.moneyfingerprint.stitch.moneyfingerprint.staging.stitch.moneyfingerprint.pre-prod.stitch.money
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The SDK logger defaults to https://analytics.stitch.money/query.
- The logger reads the embedding page’s ancestor origins or document referrer and includes the result as hostname in its error payload.
- The logger sends error messages, serialized errors, and metadata in a POST request; SDK error paths call it automatically.
Evidence against
- The package is a Stitch payment web SDK, and its runtime configuration and fingerprint endpoints are on stitch.money hosts.
- The Base64 decoding flagged by the scanner is used in a bundled ad-block filter list, not to conceal a collector URL.
- The manifest exposes explicit SDK entry points; the prepare script builds and bundles the package.
Behavioral surface
DynamicRequireNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedsecure-fields.cjsView file
10};
L11: var __commonJS = (cb, mod) => function __require() {
L12: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
secure-fields.cjsView on unpkg · L10device-data.jsView file
1631for (let i2 = 0; i2 < input.length; i2++) {
L1632: const charCode = input.charCodeAt(i2);
L1633: if (charCode > 127) {
...
L2095: // `typechange` is deprecated, but it's still present on Android (tested on Chrome Mobile 117)
L2096: // Removal proposal https://bugs.chromium.org/p/chromium/issues/detail?id=699892
L2097: // Note: this expression returns true on ChromeOS, so additional detectors are required to avoid false-positives
...
L2643: if (DateTimeFormat) {
L2644: const timezone = new DateTimeFormat().resolvedOptions().timeZone;
L2645: if (timezone) {
...
L3307: }
L3308: function getPrivateClickMeasurement() {
L3309: var _a;
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
device-data.jsView on unpkg · L1631Findings
1 High6 Medium5 Low
HighBase64 Obscured Urldevice-data.js
MediumDynamic Requiresecure-fields.cjs
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedevice-data.js
MediumAi Review Evidencedevice-data.js
MediumAi Review Evidencedevice-data.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @stitch-money/web@2.30.0.
See all versions of @stitch-money/web for other recorded verdicts.
- Review the evidence and your use of @stitch-money/web@2.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.