@zerohash-sdk/fund-withdrawals-react@0.14.10
A React SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the inspected runtime uses Zerohash-hosted widget and diagnostic endpoints for the documented withdrawal flow. The caller-provided JWT is passed to that widget; no unrelated recipient or other concrete attack behavior was identified.
Decision evidence
public snapshot- The manifest exports dist/index.js as the runtime entrypoint and contains no lifecycle scripts.
- The bundle selects the remote widget from Zerohash SDK CDN hosts according to the configured environment.
- The React component passes its caller-provided JWT to the Fund Withdrawals widget.
- On widget load failures, the bundle posts structured app, browser, and page context to environment-specific Zerohash Grafana collectors.
- The bundle performs network requests and loads a remote module; inspected source ties these actions to the Fund Withdrawals widget and its load-failure reporting.
Source & flagged code
7 flaggedThe manifest exports dist/index.js as the runtime entrypoint and contains no lifecycle scripts.
package.jsonView on unpkg · L1The bundle selects the remote widget from Zerohash SDK CDN hosts according to the configured environment.
dist/index.jsFindings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-react@0.14.10.
See all versions of @zerohash-sdk/fund-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-react@0.14.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.