registry / stablezact-pay / 0.67.0
stablezact-pay@0.67.0
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4mo ago · by lpm-firewall-aiScanner credential-exfiltration hints are explained by expected merchant API authentication headers in payment API clients and by wallet/payment SDK functionality. I found no install-time/import-time malicious execution, secret harvesting from env/files/storage, unauthorized endpoint, or AI-agent control-surface mutation beyond temporary browser meta tags for Coinley API/public-key discovery.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User imports SDK or renders CoinleyPayment/QRCodePayment/CoinleyVanilla and initiates payment flows.
Impact
No unconsented credential exfiltration, install-time execution, persistence, or destructive behavior confirmed.
Mechanism
Package-aligned payment API and wallet transaction workflow.
AI rationale
Scanner credential-exfiltration hints are explained by expected merchant API authentication headers in payment API clients and by wallet/payment SDK functionality. I found no install-time/import-time malicious execution, secret harvesting from env/files/storage, unauthorized endpoint, or AI-agent control-surface mutation beyond temporary browser meta tags for Coinley API/public-key discovery.
Evidence
package.jsonREADME.mddist/index.esm.jsdist/index-CW1p6ar4.jsdist/index-DF6Gn171.jsdist/QRCodePayment-C50CNuFu.jsdist/CoinleyPayment-C6ChHSdL.jsdist/coinley-vanilla.min.js
Network endpoints7
caller-provided apiUrl/baseURLpayment.coinley.ioapi.coinley.comli.quest/v1lite-api.jup.ag/swap/v1tokens.uniswap.orgapi.g.alchemy.com
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no install/preinstall/postinstall/prepare lifecycle hooks.
- dist/index.esm.js only re-exports SDK symbols from bundled chunks; React payment UI is lazy-loaded.
- dist/CoinleyPayment-C6ChHSdL.js sends X-Public-Key or merchant-supplied X-API-Key/X-API-Secret only to caller-provided baseURL endpoints.
- Network calls are payment/bridge/wallet aligned: /api/payments/*, /api/networks/*, /api/bridge/*, li.quest, Alchemy/Jupiter token APIs.
- Browser storage use is limited to Coinley payment state/recovery keys, not credential harvesting.
- No filesystem access, child_process, shell execution, npm lifecycle execution, or persistence code found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
3 flaggeddist/CoinleyPayment-C6ChHSdL.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2097: if (!response.ok) {
L2098: const error = await response.json().catch(() => ({}));
L2099: throw new Error(error.error || `HTTP ${response.status}`);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/CoinleyPayment-C6ChHSdL.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/index-CW1p6ar4.js -> dist/CoinleyPayment-C6ChHSdL.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2097: if (!response.ok) {
L2098: const error = await response.json().catch
Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/CoinleyPayment-C6ChHSdL.js
CriticalTrigger Reachable Dangerous Capabilitydist/CoinleyPayment-C6ChHSdL.js
HighOversized Source Filedist/coinley-vanilla.min.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.67.0.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.67.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.