@zerohash-sdk/fund-withdrawals-react@0.14.9
A React SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install lifecycle scripts, and the runtime network behavior is limited to loading the Zerohash widget and reporting widget-load failures to Zerohash collectors. The failure report includes limited metadata and selected JWT claims, but the inspected report path does not transmit the JWT itself.
Decision evidence
public snapshot- package.json exports dist/index.js and has no lifecycle scripts.
- The widget script URL is built from Zerohash environment-specific CDN hosts.
- The loader reports network errors and timeouts through its failure handler.
- The report is sent as a JSON POST to an environment-selected collector.
- The failure report includes browser and page metadata plus selected decoded JWT claims; the report code does not send the JWT itself.
- The React wrapper passes the caller-supplied JWT to the widget and uses the package’s default collector configuration.
Source & flagged code
8 flaggedpackage.json exports dist/index.js and has no lifecycle scripts.
package.jsonView on unpkg · L1The widget script URL is built from Zerohash environment-specific CDN hosts.
dist/index.jsView on unpkg · L148Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-react@0.14.9.
See all versions of @zerohash-sdk/fund-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-react@0.14.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.