registry / stablezact-pay / 0.73.2
stablezact-pay@0.73.2
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner’s credential finding is a payment client adding caller-provided legacy credentials to its configured API URL, not exfiltration to a package-controlled endpoint. Source inspection found no install-time execution or concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumer imports and uses the payment SDK or opens its UI.
Impact
No unconsented host mutation, payload execution, or credential harvesting established.
Mechanism
Configured payment API calls and analytics telemetry.
AI rationale
The scanner’s credential finding is a payment client adding caller-provided legacy credentials to its configured API URL, not exfiltration to a package-controlled endpoint. Source inspection found no install-time execution or concrete malicious chain.
Evidence
package.jsondist/index.esm.jsdist/chunk-_f7ZQ7HK.jsdist/chunk-CaqPg79K.jsdist/chunk-BlCp_aBy.js
Network endpoints3
api.coinley.comwww.clarity.ms/tag/pro-api.coinmarketcap.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- Browser bundle includes Mixpanel and Clarity telemetry.
- Legacy API credentials are attached only to the configured API base URL.
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- Entrypoint exports SDK code; payment UI is lazy-loaded on use.
- PaymentAPI derives its base URL from the caller-supplied configuration.
- No package code reads host env, files, or invokes shell/eval.
- No fixed credential-exfiltration endpoint found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
3 flaggeddist/chunk-BlCp_aBy.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2099: if (!response.ok) {
L2100: const error = await response.json().catch(() => ({}));
L2101: throw new Error(error.error || `HTTP ${response.status}`);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-BlCp_aBy.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/chunk-_f7ZQ7HK.js -> dist/chunk-BlCp_aBy.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2099: if (!response.ok) {
L2100: const error = await response.json().catch(() => ({
Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/chunk-BlCp_aBy.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-BlCp_aBy.js
HighOversized Source Filedist/stablezact-vanilla.min.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.73.2.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.73.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.