@zerohash-sdk/fiat-withdrawals-react@1.15.12
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Withdrawals product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends runtime error telemetry to ZeroHash on widget load failures, including page origin, browser user agent, and selected JWT claims. The README does not disclose this telemetry or provide an opt-out, so this is suspicious rather than malicious.
Decision evidence
public snapshot- On a widget script-load failure, the package builds an error report containing the app and environment, script URL, failure reason, timing, and claims decoded from the supplied JWT.
- The report also includes the browser user agent and the current page origin, then sends the payload by HTTP POST to an environment-specific ZeroHash Grafana Faro collector.
- The README describes the component props but does not disclose this reporting or provide a telemetry opt-out.
- Reporting is tied to a remote widget load failure, not ordinary package import.
- The collector hosts belong to ZeroHash, and the code sends selected JWT claims rather than the raw JWT.
Source & flagged code
5 flaggedOn a widget script-load failure, the package builds an error report containing the app and environment, script URL, failure reason, timing, and claims decoded from the supplied JWT.
dist/index.jsView on unpkg · L97On a widget script-load failure, the package builds an error report containing the app and environment, script URL, failure reason, timing, and claims decoded from the supplied JWT.
dist/index.jsView on unpkg · L51Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-withdrawals-react@1.15.12.
See all versions of @zerohash-sdk/fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-withdrawals-react@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.