@zerohash-sdk/fund-withdrawals-react@0.14.7
A React SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe published entrypoint loads the intended Zerohash withdrawal widget from Zerohash CDN hosts. Its telemetry is limited to diagnostics sent to Zerohash collectors after a loading failure, so the inspected source does not establish a malicious attack surface.
Decision evidence
public snapshot- The manifest exports dist/index.js as the package entrypoint.
- The widget accepts a JWT for authentication and passes it to the withdrawal component; diagnostic data includes selected token claims.
- Failure reports use configured Zerohash collector URLs and send a JSON POST.
- Reports are triggered by remote component load failures and contain browser, page, and load-error details.
- The wrapper loads the remote component from environment-specific Zerohash CDN URLs.
Source & flagged code
8 flaggedThe manifest exports dist/index.js as the package entrypoint.
package.jsonView on unpkg · L1The widget accepts a JWT for authentication and passes it to the withdrawal component; diagnostic data includes selected token claims.
dist/index.d.tsView on unpkg · L73Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-react@0.14.7.
See all versions of @zerohash-sdk/fund-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-react@0.14.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.