stablezact-pay@0.73.10
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4d ago · by lpm-firewall-aiI found no credential harvesting or malicious install behavior. However, the payment UI sends payment identifiers and partial wallet addresses to third-party analytics by default, with no evident disclosure or opt-out in the inspected package, so this warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Opening the payment modal and subsequent payment or wallet events.
Impact
Third parties receive payment identifiers, amounts, merchant details, and a partial wallet address; Clarity may also collect session activity.
Mechanism
The SDK tracks events through Mixpanel and initializes Microsoft Clarity, without an evident consent prompt or opt-out in the inspected code.
AI rationale
I found no credential harvesting or malicious install behavior. However, the payment UI sends payment identifiers and partial wallet addresses to third-party analytics by default, with no evident disclosure or opt-out in the inspected package, so this warrants a warning.
Evidence
dist/chunk-bzBS_7vC.jsdist/chunk-n1_VUMWp.js
Network endpoints2
api-js.mixpanel.comwww.clarity.ms/tag/
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundle initializes Mixpanel with an embedded project token and sends analytics to Mixpanel’s API host.
- Payment analytics include payment IDs and amounts.
- Wallet connection analytics include the first 10 characters of the wallet address.
- Opening the payment modal triggers analytics and initializes Clarity; Clarity loads its script from www.clarity.ms.
Evidence against
- The package is a blockchain payment SDK, so payment and wallet event tracking relates to its stated purpose.
- The manifest has no install or lifecycle hook.
- The API client sends caller-provided API credentials to its configured API URL; I found no code collecting machine credentials.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunk-n1_VUMWp.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L69: }
L70: const smallLogo = "data:image/png;base64,[redacted]...
L71: const rpcTransactionType = {
...
L414: default: {
L415: http: ["https://api.mainnet.abs.xyz"],
L416: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L5542: // It's faster, but should only be used when you don't care about
L5543: // an exposed private key e.g. sig verification.
L5544: // Does NOT allow scalars higher than CURVE.n.
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-n1_VUMWp.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/chunk-bzBS_7vC.js -> dist/chunk-n1_VUMWp.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L69: }
L70: const smallLogo = "data:image/png;base64,[redacted]...
L71: const rpcTransactionType = {
...
L414: default: {
L415: http: ["https://api.mainnet.abs.xyz"],
L416: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L5542: // It's faster, but should only be used when you don't care about
L5543: // an exposed private key e.g. sig verification.
L5544: // Does NOT allow scalars higher than CURVE
Findings
2 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-n1_VUMWp.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-n1_VUMWp.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-n1_VUMWp.js
HighSemantic Analysis Limiteddist/chunk-bzBS_7vC.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/stablezact-vanilla.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.73.10.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.73.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.