registry / stablezact-pay / 0.66.0
stablezact-pay@0.66.0
Seamless blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection shows expected payment-SDK behavior: runtime API authentication, wallet/RPC calls, token/price lookups, analytics, and optional merchant callback URLs. The scanner's credential-exfiltration label appears to conflate user-supplied merchant auth headers with malicious secret harvesting.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or using SDK components; payment, bridge, swap, analytics, or callback requests occur during SDK runtime actions.
Impact
No evidence of credential harvesting, install-time execution, persistence, destructive action, or covert exfiltration.
Mechanism
user-invoked payment SDK networking and wallet operations
AI rationale
Static source inspection shows expected payment-SDK behavior: runtime API authentication, wallet/RPC calls, token/price lookups, analytics, and optional merchant callback URLs. The scanner's credential-exfiltration label appears to conflate user-supplied merchant auth headers with malicious secret harvesting.
Evidence
package.jsonREADME.mddist/index.esm.jsdist/index.umd.jsdist/index-DYkC2Bui.jsdist/CoinleyPayment-BA2ym_mw.jsdist/index-BTn5xw-W.jsdist/QRCodePayment-C50CNuFu.js
Network endpoints12
api.coinley.ioapi.coinley.compayment.coinley.ioapi-js.mixpanel.comwww.clarity.ms/tag/pro-api.coinmarketcap.comli.quest/v1lite-api.jup.ag/swap/v1solana-mainnet.g.alchemy.com/v2/YWG990wOlIikc1tU7-WWTepfU8d1f4dp
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- dist/index-DYkC2Bui.js embeds Mixpanel/Clarity analytics and hardcoded service API keys, but they are used for SDK telemetry/rate lookups, not harvested secrets.
- dist/index-DYkC2Bui.js and dist/CoinleyPayment-BA2ym_mw.js send caller-supplied apiKey/apiSecret/publicKey headers to configured payment apiUrl.
Evidence against
- package.json has no install/preinstall/postinstall lifecycle hooks.
- Root exports point to dist/index.esm.js and dist/index.umd.js; no child_process, filesystem writes, or native/binary loading found.
- Credential-looking headers are part of PaymentAPI/SimplePaymentAPI merchant-auth requests to user-configured Coinley/payment endpoints.
- Network calls are package-aligned for payments, wallet/RPC, bridge/swap, token lists, analytics, and optional callbackUrl supplied by integrator.
- process.env assignment in dist/index-DYkC2Bui.js is a browser polyfill stub, not environment harvesting.
- Vanilla auto-init only reads script data-* attributes and constructs the SDK when merchant credentials/apiUrl are present.
Behavioral surface
Source & flagged code
3 flaggeddist/CoinleyPayment-BA2ym_mw.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2097: if (!response.ok) {
L2098: const error = await response.json().catch(() => ({}));
L2099: throw new Error(error.error || `HTTP ${response.status}`);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/CoinleyPayment-BA2ym_mw.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/index-DYkC2Bui.js -> dist/CoinleyPayment-BA2ym_mw.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2097: if (!response.ok) {
L2098: const error = await response.json().catch
Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/CoinleyPayment-BA2ym_mw.js
CriticalTrigger Reachable Dangerous Capabilitydist/CoinleyPayment-BA2ym_mw.js
HighOversized Source Filedist/coinley-vanilla.min.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.66.0.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.66.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.