@zerohash-sdk/fund-withdrawals-js@0.14.12
A framework-agnostic JavaScript SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s widget-loading purpose explains its first-party network requests, but it also sends undocumented failure telemetry containing account-linked claims and browser context. This warrants a warning for undisclosed runtime telemetry; the report is only triggered during widget loading failures.
Decision evidence
public snapshot- On script-load failure, the SDK builds a report containing JWT-derived participant and platform claims, region, browser user agent, page origin, and failure details.
- The report is sent as a JSON POST with keepalive enabled.
- The report collector URLs are Zerohash Grafana Faro endpoints.
- The loader sends the report from its failure handler; loading is invoked when the widget is rendered.
- The package has no lifecycle scripts, and its documented usage explicitly calls render() to load the widget.
- The telemetry goes to the package vendor’s collector, and the package’s main entry defines the loader rather than sending a report immediately on import.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgOn script-load failure, the SDK builds a report containing JWT-derived participant and platform claims, region, browser user agent, page origin, and failure details.
dist/index.jsView on unpkg · L41Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-js@0.14.12.
See all versions of @zerohash-sdk/fund-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-js@0.14.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.