@zerohash-sdk/csp-crypto-withdrawals-react@1.15.10
A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package performs runtime error reporting to its vendor’s collector, including browser, page, and JWT claim metadata. The reporting is failure-triggered and does not include the raw JWT, but it is not disclosed or configurable in the package documentation, so this warrants a warning.
Decision evidence
public snapshot- When a widget load fails, the loader reports the failure details and parsed JWT claims to its configured collector.
- The telemetry includes the app name, version and environment, browser user agent, and page origin.
- The default production collector is a ZeroHash Grafana Faro endpoint.
- The package has no lifecycle scripts and exports a React component.
- The report is triggered by a widget load failure; the source does not show the raw JWT being sent.
Source & flagged code
6 flaggedWhen a widget load fails, the loader reports the failure details and parsed JWT claims to its configured collector.
dist/index.jsView on unpkg · L92When a widget load fails, the loader reports the failure details and parsed JWT claims to its configured collector.
dist/index.jsFindings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-withdrawals-react@1.15.10.
See all versions of @zerohash-sdk/csp-crypto-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-react@1.15.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.