@zerohash-sdk/fund-withdrawals-js@0.14.7
A framework-agnostic JavaScript SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected runtime is a widget SDK whose network activity follows an explicit render call. Its failure telemetry goes to a Zerohash collector and carries selected diagnostic metadata; the source does not establish malicious behavior.
Decision evidence
public snapshot- The manifest points to the bundled JavaScript entrypoint and TypeScript declarations.
- The declared API requires a JWT and exposes an explicit render method for the widget.
- The runtime sends a diagnostic report to a Zerohash collector when the widget script fails to load; the report includes app and session details, browser and page metadata, and selected JWT claims.
- The loader uses a package-specific fund-withdrawals web component and loads it when rendering.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declared API requires a JWT and exposes an explicit render method for the widget.
dist/index.d.tsView on unpkg · L30The declared API requires a JWT and exposes an explicit render method for the widget.
dist/index.d.tsView on unpkg · L90Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-js@0.14.7.
See all versions of @zerohash-sdk/fund-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-js@0.14.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.