@zerohash-sdk/fund-withdrawals-js@0.14.11
A framework-agnostic JavaScript SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK reports script-loading failures to Zerohash with partner or participant claims, browser details, and the embedding page’s origin. This runtime telemetry is not disclosed in the README and has no documented opt-out, so the package is suspicious rather than clean.
Decision evidence
public snapshot- On script-load failure, the loader reports an error with JWT claims to a Faro collector.
- The report payload can include participant and platform identifiers, region, browser user agent, and the embedding page’s origin.
- The report is sent as a JSON POST to hard-coded Zerohash collector endpoints.
- Reporting is triggered by the widget loader during script loading; the README documents calling render() but does not disclose telemetry or provide a way to disable it.
- The collector endpoints belong to Zerohash, the SDK’s service provider, and the report is limited to a script-loading failure path.
- The SDK loads its widget script when render() is called, consistent with the package’s documented purpose.
- The manifest has no lifecycle scripts, and no package code runs a report merely on import.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgReporting is triggered by the widget loader during script loading; the README documents calling render() but does not disclose telemetry or provide a way to disable it.
dist/index.d.tsView on unpkg · L227Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-js@0.14.11.
See all versions of @zerohash-sdk/fund-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-js@0.14.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.