stablezact-pay@0.73.6
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged bundle behavior is primarily ordinary checkout and wallet functionality, and the reviewed code did not establish credential theft. However, checkout events automatically send payment IDs and amounts to Mixpanel without a documented disclosure or opt-out, which warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user opens checkout or creates a payment, invoking analytics tracking.
Impact
Payment IDs and amounts are disclosed to a third-party analytics service without a documented opt-out.
Mechanism
The SDK initializes Mixpanel with an embedded token and tracks payment identifiers and transaction details to its configured analytics host.
AI rationale
The flagged bundle behavior is primarily ordinary checkout and wallet functionality, and the reviewed code did not establish credential theft. However, checkout events automatically send payment IDs and amounts to Mixpanel without a documented disclosure or opt-out, which warrants a warning.
Evidence
dist/chunk-4mT0Jh_S.jsdist/chunk-BaN4BHqB.js
Network endpoints1
api-js.mixpanel.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is a blockchain payment SDK whose ESM entry exports checkout and payment components.
- The bundled analytics code initializes Mixpanel with a hard-coded project token.
- Checkout payment creation sends the payment ID, amount, network, and token to the SDK analytics tracker.
- Mixpanel's configured analytics host is api-js.mixpanel.com.
Evidence against
- The manifest declares no install lifecycle scripts.
- The payment API uses credentials supplied to the SDK and sends them through its configured payment API client.
- The reviewed checkout telemetry contains payment-flow fields; no automatic collection of environment variables or wallet secrets was found.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunk-BaN4BHqB.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L170: eip712Meta: {
L171: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L172: ...args.paymaster && args.paymasterInput ? {
...
L374: default: {
L375: http: ["https://api.mainnet.abs.xyz"],
L376: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2114: if (!response.ok) {
L2115: const error = await response.json().catch(() => ({}));
L2116: throw new Error(error.error || `HTTP ${response.status}`);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-BaN4BHqB.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/chunk-4mT0Jh_S.js -> dist/chunk-BaN4BHqB.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L170: eip712Meta: {
L171: ...args.gasPerPubdata ? { gasPerPubdata: toHex(args.gasPerPubdata) } : { gasPerPubdata: toHex(gasPerPubdataDefault) },
L172: ...args.paymaster && args.paymasterInput ? {
...
L374: default: {
L375: http: ["https://api.mainnet.abs.xyz"],
L376: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L2114: if (!response.ok) {
L2115: const error = await response.json().catch(() => ({
Findings
2 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-BaN4BHqB.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-BaN4BHqB.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-BaN4BHqB.js
HighSemantic Analysis Limiteddist/chunk-4mT0Jh_S.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/stablezact-vanilla.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.73.6.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.73.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.