@zerohash-sdk/fund-withdrawals-react@0.14.8
A React SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the runtime network behavior is limited to loading the package’s vendor widget and sending diagnostics to its vendor collector after a load failure. The diagnostic payload includes limited identifying context, but the inspected source does not establish a malicious attack surface.
Decision evidence
public snapshot- The manifest exports the React bundle and declares no lifecycle scripts or runtime dependencies beyond React peers.
- The bundle loads the named widget from environment-specific ZeroHash CDN hosts.
- On widget load failure, it sends diagnostic context to environment-specific ZeroHash collector hosts.
- The diagnostic payload includes app and environment details, selected JWT claims, browser user agent, page origin, and failure context.
- The report is sent as JSON only when a collector URL and browser fetch are available.
Source & flagged code
8 flaggedThe manifest exports the React bundle and declares no lifecycle scripts or runtime dependencies beyond React peers.
package.jsonView on unpkg · L1The bundle loads the named widget from environment-specific ZeroHash CDN hosts.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-react@0.14.8.
See all versions of @zerohash-sdk/fund-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-react@0.14.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.