@zerohash-sdk/fund-withdrawals-js@0.14.0
A framework-agnostic JavaScript SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe inspected runtime is a browser SDK that loads its widget from fixed Zerohash CDN hosts and reports load failures to fixed Zerohash collectors. Telemetry includes selected JWT claims and browser diagnostics, but the inspected code does not send the raw token or show an unrelated destination, so no malicious attack surface was established.
Decision evidence
public snapshot- package.json exposes dist/index.js as the runtime entrypoint and declares no lifecycle scripts.
- The SDK requires a caller-provided JWT; telemetry extracts selected claims rather than forwarding the raw token.
- On script-load errors, telemetry posts diagnostic data to fixed Zerohash collector endpoints.
- The report includes app and environment details, selected JWT claims, browser user agent, and page origin; the CDN hosts are also Zerohash endpoints.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe SDK requires a caller-provided JWT; telemetry extracts selected claims rather than forwarding the raw token.
dist/index.d.tsView on unpkg · L25Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-js@0.14.0.
See all versions of @zerohash-sdk/fund-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-js@0.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.