registry / stablezact-pay
stablezact-pay
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
This report shows the evidence for stablezact-pay@0.73.20. 0 of 21 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flow sends merchant-supplied API credentials to the resolved Stablezact payment API. The other inspected callback sends limited payment status only to a callback URL provided in configuration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer uses the payment component or API, and payment callbacks require a configured callback URL.
Impact
The inspected flows support payment processing and status reporting; no unrelated credential collection or exfiltration was found.
Mechanism
The SDK sends supplied API credentials to its resolved payment API and may report a payment timeout to the configured callback.
AI rationale
The flagged credential flow sends merchant-supplied API credentials to the resolved Stablezact payment API. The other inspected callback sends limited payment status only to a callback URL provided in configuration.
Evidence
package.jsondist/chunk-Dne7KPfa.jsdist/chunk-W9JRAcHR.js
Network endpoints4
talented-mercy-production.up.railway.apphub.stablezact.compaymentscreen-h9e8.vercel.apppayment.stablezact.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes built SDK entry points and declares no install lifecycle hook.
- The payment API client sends the supplied API key and secret to its resolved API base URL.
- The default API base URLs are the Stablezact staging and production services.
- A payment timeout callback is sent only when payment data and a configured callback URL exist.
- The payment component is lazy-loaded for use.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunk-Dne7KPfa.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L69: }
L70: const smallLogo = "data:image/png;base64,[redacted]...
L71: const rpcTransactionType = {
...
L414: default: {
L415: http: ["https://api.mainnet.abs.xyz"],
L416: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L5541: // It's faster, but should only be used when you don't care about
L5542: // an exposed private key e.g. sig verification.
L5543: // Does NOT allow scalars higher than CURVE.n.
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-Dne7KPfa.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/chunk-W9JRAcHR.js -> dist/chunk-Dne7KPfa.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L69: }
L70: const smallLogo = "data:image/png;base64,[redacted]...
L71: const rpcTransactionType = {
...
L414: default: {
L415: http: ["https://api.mainnet.abs.xyz"],
L416: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L5541: // It's faster, but should only be used when you don't care about
L5542: // an exposed private key e.g. sig verification.
L5543: // Does NOT allow scalars higher than CURVE
Findings
2 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-Dne7KPfa.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-Dne7KPfa.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-Dne7KPfa.js
HighSemantic Analysis Limiteddist/chunk-W9JRAcHR.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/stablezact-vanilla.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.73.20.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of stablezact-pay@0.73.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.