@zerohash-sdk/fund-withdrawals-js@0.14.4
A framework-agnostic JavaScript SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package exposes a JWT-authenticated widget SDK with no install lifecycle scripts. Its inspected network behavior is limited to loading the widget from Zerohash CDN domains and sending failure telemetry, including selected JWT claims, to Zerohash collector endpoints; no attack behavior was identified.
Decision evidence
public snapshot- package.json points consumers to dist/index.js and declares no lifecycle scripts.
- dist/index.d.ts describes a JWT-authenticated widget SDK.
- dist/index.js sends failure telemetry containing selected JWT claims to Zerohash Grafana Faro collector endpoints.
- dist/index.js loads the widget as a module from Zerohash SDK CDN domains when the widget is rendered.
- Telemetry is tied to script-load failure handling; no unrelated credential collection or attack behavior was identified.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgdist/index.d.ts describes a JWT-authenticated widget SDK.
dist/index.d.tsView on unpkg · L25Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-js@0.14.4.
See all versions of @zerohash-sdk/fund-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-js@0.14.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.