@zerohash-sdk/fiat-withdrawals-react@1.13.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Withdrawals product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a React wrapper for a remotely hosted, vendor-aligned fiat-withdrawal widget. Its network and telemetry behavior is component-triggered and no malicious install, exfiltration, or host-control behavior was found.
Decision evidence
public snapshot- The rendered component injects a module script from a Zero Hash SDK CDN.
- On script-load failure it posts diagnostic metadata to a Zero Hash Grafana collector.
- package.json has no lifecycle scripts, dependencies, bin entry, or install-time execution.
- Remote loading occurs only when the exported React component is rendered.
- The telemetry payload uses selected decoded JWT claims and browser/page metadata, not the JWT value.
- No filesystem access, shell execution, dynamic evaluation, persistence, or destructive behavior was found.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe rendered component injects a module script from a Zero Hash SDK CDN.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-withdrawals-react@1.13.0.
See all versions of @zerohash-sdk/fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-withdrawals-react@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.