@zerohash-sdk/crypto-withdrawals-js@1.14.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Withdrawals product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic source inspection shows a browser SDK that loads a Zerohash withdrawal widget only during consumer-initiated rendering and reports load failures. No malicious install hook, exfiltration of secrets, filesystem access, execution primitive, or persistence mechanism was found.
Decision evidence
public snapshot- The SDK dynamically injects a module script from its fixed Zerohash CDN map when the consumer renders the widget.
- On script-load failure, it posts diagnostic telemetry to Zerohash Grafana collector endpoints.
- The declaration file identifies this as a browser widget integration SDK.
- package.json has no lifecycle scripts, dependencies, or executable bin entry.
- Source has no child-process, filesystem, environment harvesting, eval, persistence, or install-time behavior.
- Network and remote script loading are user-invoked through render() and align with the declared browser-widget purpose.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declaration file identifies this as a browser widget integration SDK.
dist/index.d.tsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-withdrawals-js@1.14.0.
See all versions of @zerohash-sdk/crypto-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-withdrawals-js@1.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.