@zerohash-sdk/fund-withdrawals-js@0.12.0
A framework-agnostic JavaScript SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser widget loader with no lifecycle hooks or local system access. Its remote script and telemetry behavior is visible, user-invoked, and aligned with the SDK's stated function; no concrete malicious behavior was found.
Decision evidence
public snapshot- The manifest has no lifecycle scripts and exports only the distributed SDK.
- The browser SDK loads a configured remote web-component script when render is called.
- On load failure it sends telemetry containing limited browser and JWT-claim context to vendor collector URLs.
- No install-time execution, shell commands, filesystem access, obfuscation, or persistence was found.
- Remote loading and telemetry occur only through the user-invoked widget rendering path and use Zerohash-named endpoints.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgOn load failure it sends telemetry containing limited browser and JWT-claim context to vendor collector URLs.
dist/index.d.tsView on unpkg · L225Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-js@0.12.0.
See all versions of @zerohash-sdk/fund-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-js@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.