@zerohash-sdk/csp-fiat-withdrawals-react
A React SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.
This report shows the evidence for @zerohash-sdk/csp-fiat-withdrawals-react@0.13.12. 0 of 21 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends failure-triggered runtime telemetry to its own collector, including the browser user agent and page origin. The source does not document a way to disable this reporting, so classify it as suspicious telemetry.
Decision evidence
public snapshot- When the widget is mounted, an effect starts loading its web component and configures the telemetry collector.
- On a load failure, the package sends a POST containing diagnostic context to the collector.
- The report includes the browser user agent and page origin, along with app and failure details.
- The default production collector is a Zerohash Grafana Faro endpoint.
- The collector host belongs to Zerohash, the package’s stated service.
- Telemetry is triggered by a web-component load failure rather than package import.
- The manifest has no lifecycle scripts.
Source & flagged code
4 flaggedThe report includes the browser user agent and page origin, along with app and failure details.
dist/index.jsView on unpkg · L57On a load failure, the package sends a POST containing diagnostic context to the collector.
dist/index.jsView on unpkg · L78When the widget is mounted, an effect starts loading its web component and configures the telemetry collector.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-fiat-withdrawals-react@0.13.12.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-react@0.13.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.