@zerohash-sdk/csp-fiat-withdrawals-react@0.13.6
A React SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe shipped entrypoint loads the package-aligned Zerohash withdrawal widget and sends limited diagnostics to Zerohash collectors only on load failure. No lifecycle hook, credential exfiltration, or other attack behavior was identified.
Decision evidence
public snapshot- package.json exposes dist/index.js and contains no lifecycle script.
- The wrapper passes the caller-supplied JWT and environment to the Zerohash withdrawals widget.
- The widget script URLs use Zerohash CDN hosts for the selected environment.
- Load-failure telemetry includes browser user-agent and page origin.
- The loader posts failure reports to an environment-specific Zerohash collector.
Source & flagged code
8 flaggedpackage.json exposes dist/index.js and contains no lifecycle script.
package.jsonView on unpkg · L1The wrapper passes the caller-supplied JWT and environment to the Zerohash withdrawals widget.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-fiat-withdrawals-react@0.13.6.
See all versions of @zerohash-sdk/csp-fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-react@0.13.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.