@zerohash-sdk/fund-withdrawals-react@0.14.6
A React SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe published entrypoint’s network behavior supports the package’s withdrawal-widget integration: it loads scripts from Zerohash CDN hosts and sends diagnostics on load failure to Zerohash collectors. The inspected failure payload contains diagnostic metadata, not the JWT passed to the widget.
Decision evidence
public snapshot- The manifest exports the React entrypoint and declares no lifecycle scripts or runtime dependencies.
- The widget loads region-specific scripts from Zerohash SDK CDN hosts.
- The component passes the caller-provided JWT to the Zerohash widget and reports loader failures to the configured collector.
- Failure diagnostics contain app, session, browser, page, and load-error metadata; no JWT is included in the shown payload.
Source & flagged code
7 flaggedThe manifest exports the React entrypoint and declares no lifecycle scripts or runtime dependencies.
package.jsonView on unpkg · L3The widget loads region-specific scripts from Zerohash SDK CDN hosts.
dist/index.jsView on unpkg · L146Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-react@0.14.6.
See all versions of @zerohash-sdk/fund-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-react@0.14.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.