@zerohash-sdk/csp-fiat-withdrawals-react@0.13.3
A React SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe manifest points consumers to a browser React bundle and contains no install lifecycle hooks. The bundle performs product-aligned remote SDK loading and error telemetry to Zerohash endpoints, with no inspected evidence of malicious behavior.
Decision evidence
public snapshot- package.json declares a public ESM React package whose main entrypoint is dist/index.js, with no lifecycle scripts.
- The bundle sends an error report containing app, browser, page-origin, and selected claim metadata to configured collector URLs.
- The bundle loads a selected remote module script when its React hook runs and reports script-load failures.
- The inspected behavior is consistent with this browser SDK: telemetry targets named Zerohash collector hosts and remote module URLs use Zerohash SDK CDN hosts.
- No credential harvesting, shell execution, persistence, or destructive behavior was identified in the inspected entrypoint.
Source & flagged code
7 flaggedpackage.json declares a public ESM React package whose main entrypoint is dist/index.js, with no lifecycle scripts.
package.jsonView on unpkg · L2The bundle sends an error report containing app, browser, page-origin, and selected claim metadata to configured collector URLs.
dist/index.jsView on unpkg · L48Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-fiat-withdrawals-react@0.13.3.
See all versions of @zerohash-sdk/csp-fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-react@0.13.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.