@zerohash-sdk/crypto-withdrawals-react@1.15.13
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Withdrawals product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package's purpose and default collector are consistent with a ZeroHash React widget, but its failure-triggered telemetry sends browser and page-origin data without disclosure or an opt-out. This is suspicious runtime telemetry, not evidence of credential theft or malicious install behavior.
Decision evidence
public snapshot- When the widget's script load fails, the SDK posts a diagnostic event to a default ZeroHash Grafana Faro collector.
- The diagnostic includes the browser user agent and the embedding page's origin, along with app metadata and script-load details.
- The package documentation describes the React withdrawal widget but does not disclose this runtime telemetry or provide an opt-out.
- The manifest has no lifecycle scripts; the package exports a React component for a crypto-withdrawal product.
- Telemetry is conditional on a widget script-load failure, and the collector endpoints belong to ZeroHash.
Source & flagged code
4 flaggedWhen the widget's script load fails, the SDK posts a diagnostic event to a default ZeroHash Grafana Faro collector.
dist/index.jsView on unpkg · L78The diagnostic includes the browser user agent and the embedding page's origin, along with app metadata and script-load details.
dist/index.jsFindings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-withdrawals-react@1.15.13.
See all versions of @zerohash-sdk/crypto-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-withdrawals-react@1.15.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.