@zerohash-sdk/csp-fiat-withdrawals-react@0.13.10
A React SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends undisclosed runtime telemetry to Zerohash when the remote widget fails to load, including browser and page details and selected JWT claims. The failure-only trigger and first-party collector fit error reporting, but the data collection lacks disclosure or an opt-out in this package, so this is suspicious rather than malicious.
Decision evidence
public snapshot- The package entry point is dist/index.js, which exports the React withdrawal widget.
- On remote widget load errors, timeouts, or registration failures, the code reports an error to the configured collector.
- The report includes browser user agent and page origin, along with app, environment, and error details.
- The report also includes participant and platform claims decoded from the supplied JWT.
- The collector is a Zerohash Grafana Faro endpoint, consistent with error reporting for this SDK.
- Reporting is triggered by widget loading failures, not by importing the package alone.
- The package has no lifecycle scripts and declares React as a peer dependency.
Source & flagged code
6 flaggedThe package entry point is dist/index.js, which exports the React withdrawal widget.
package.jsonView on unpkg · L6On remote widget load errors, timeouts, or registration failures, the code reports an error to the configured collector.
dist/index.jsView on unpkg · L121Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-fiat-withdrawals-react@0.13.10.
See all versions of @zerohash-sdk/csp-fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-react@0.13.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.