registry / stablezact-pay / 0.73.4
stablezact-pay@0.73.4
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package presents itself as a crypto payment SDK, and the examined outbound callback is conditional on a caller-provided URL. Although a Mixpanel helper is present, the review did not establish automatic invocation or credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
SDK import and explicit payment UI use; a timeout callback requires the caller to configure callbackUrl.
Impact
No unauthorized credential collection, unrelated data transfer, or harmful default action was established.
Mechanism
The inspected network behavior supports payment and blockchain operations; the timeout notification posts payment status fields to the configured callback URL.
AI rationale
The package presents itself as a crypto payment SDK, and the examined outbound callback is conditional on a caller-provided URL. Although a Mixpanel helper is present, the review did not establish automatic invocation or credential exfiltration.
Network endpoints1
The caller-configured callbackUrl
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a React and vanilla JavaScript crypto payment gateway SDK and exports its built SDK entry points.
- Payment timeout details are posted only when the caller supplies a callbackUrl, and the request contains payment status fields.
- The bundle includes a Mixpanel analytics helper, but the reviewed source did not establish that it runs automatically.
Evidence against
- The bundle contains a Mixpanel analytics helper configured to initialize Mixpanel and persist data in localStorage.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunk-SMdnfbLI.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2099: if (!response.ok) {
L2100: const error = await response.json().catch(() => ({}));
L2101: throw new Error(error.error || `HTTP ${response.status}`);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-SMdnfbLI.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/chunk-DsCKCTnK.js -> dist/chunk-SMdnfbLI.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L155: eip712Meta: {
L156: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L157: ...args.paymaster && args.paymasterInput ? {
...
L359: default: {
L360: http: ["https://api.mainnet.abs.xyz"],
L361: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2099: if (!response.ok) {
L2100: const error = await response.json().catch(() => ({
Findings
2 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-SMdnfbLI.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-SMdnfbLI.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-SMdnfbLI.js
HighSemantic Analysis Limiteddist/chunk-DsCKCTnK.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/stablezact-vanilla.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.73.4.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.73.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.