@zerohash-sdk/crypto-withdrawals-react@1.13.3
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Withdrawals product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found a browser-only React wrapper with no lifecycle hooks or local system access. Its CDN widget loading and failure telemetry are explicit runtime behavior aligned with its stated purpose, not concrete malicious behavior.
Decision evidence
public snapshot- The manifest has no lifecycle scripts and exports only the compiled module.
- Rendering the component injects a configured remote module script into the browser document.
- Failed remote-script loads send diagnostic telemetry to configured ZeroHash collector URLs.
- No install-time execution, shell commands, filesystem access, or persistence was found.
- The remote loading occurs only when the exported React component is rendered.
- The observed network behavior is limited to the withdrawal widget CDN and load-failure telemetry.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest has no lifecycle scripts and exports only the compiled module.
package.jsonView on unpkg · L5Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-withdrawals-react@1.13.3.
See all versions of @zerohash-sdk/crypto-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-withdrawals-react@1.13.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.