@zerohash-sdk/crypto-withdrawals-react@1.15.11
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Withdrawals product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe widget loader’s failure reporting sends browser and page details together with JWT-derived claims to a ZeroHash collector without disclosure or an opt-out. This is undisclosed runtime telemetry, so the package warrants a warning rather than a block.
Decision evidence
public snapshot- On SDK load failure, the package builds a diagnostic payload containing browser user-agent, page origin, app details, and JWT-derived participant, platform, and region claims.
- It automatically POSTs that payload as JSON to a Faro collector endpoint.
- Reporting is triggered by a network error or timeout while loading the remote widget script.
- The README documents widget setup but does not disclose this diagnostic reporting or an opt-out.
- The package is a React wrapper for ZeroHash’s crypto withdrawal widget, and loads that widget from ZeroHash CDN hosts.
- The diagnostic request is limited to widget loading failures; source shows no install lifecycle scripts.
Source & flagged code
5 flaggedOn SDK load failure, the package builds a diagnostic payload containing browser user-agent, page origin, app details, and JWT-derived participant, platform, and region claims.
dist/index.jsView on unpkg · L57It automatically POSTs that payload as JSON to a Faro collector endpoint.
dist/index.jsView on unpkg · L74It automatically POSTs that payload as JSON to a Faro collector endpoint.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-withdrawals-react@1.15.11.
See all versions of @zerohash-sdk/crypto-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-withdrawals-react@1.15.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.