@zerohash-sdk/csp-fiat-withdrawals-react@0.13.9
A React SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or concrete attack behavior. The CDN loading and failure reporting are tied to the Zerohash widget and collector.
Decision evidence
public snapshot- The manifest points to the distribution entrypoint and lists React as a peer dependency; it contains no lifecycle script.
- The component passes its caller-provided JWT to the Zerohash withdrawal widget and loads the widget from environment-specific Zerohash CDN hosts.
- On widget load failure, the package posts app and session diagnostics to a Zerohash collector; the inspected code shows no attack behavior.
Source & flagged code
8 flaggedThe manifest points to the distribution entrypoint and lists React as a peer dependency; it contains no lifecycle script.
package.jsonView on unpkg · L1The manifest points to the distribution entrypoint and lists React as a peer dependency; it contains no lifecycle script.
package.jsonView on unpkg · L15Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-fiat-withdrawals-react@0.13.9.
See all versions of @zerohash-sdk/csp-fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-react@0.13.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.