registry / stablezact-pay / 0.73.8
stablezact-pay@0.73.8
Beautiful and smooth blockchain payment gateway SDK for seamless crypto payments - React & vanilla js
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package exposes a browser payment SDK without install hooks. The flagged credential flows are consistent with its function: supplied API credentials go to the configured payment API, and fixed RPC keys are used with Alchemy endpoints.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Requests occur when the consuming application uses payment or blockchain features; timeout callbacks require a configured callback URL.
Impact
The reviewed behavior does not show unrelated credential disclosure, unauthorized account actions, or install-time activity.
Mechanism
The SDK sends supplied API credentials to its configured API URL and uses fixed Alchemy keys for RPC requests.
AI rationale
The package exposes a browser payment SDK without install hooks. The flagged credential flows are consistent with its function: supplied API credentials go to the configured payment API, and fixed RPC keys are used with Alchemy endpoints.
Evidence
package.jsondist/index.esm.jsdist/chunk-CcG5KOnW.js
Network endpoints4
Configured payment API URLConfigured callbackUrlanime-mainnet.g.alchemy.comsolana-mainnet.g.alchemy.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to browser SDK bundles and declares no install lifecycle script.
- The SDK sends explicit API key or secret headers with requests to its configured payment API URL.
- The RPC keys in the bundle are used in Alchemy chain RPC URLs; no ambient credential collection or unrelated credential destination was identified.
Evidence against
- The bundle contains fixed Alchemy API keys, which are exposed to package consumers.
- The code sends a payment timeout event to a callback URL supplied in configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/chunk-CcG5KOnW.jsView file
6import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L30: };
L31: const smallLogo = "data:image/png;base64,[redacted]...
L32: const rpcTransactionType = {
...
L375: default: {
L376: http: ["https://api.mainnet.abs.xyz"],
L377: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L5393: // It's faster, but should only be used when you don't care about
L5394: // an exposed private key e.g. sig verification.
L5395: // Does NOT allow scalars higher than CURVE.n.
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-CcG5KOnW.jsView on unpkg · L66Trigger-reachable chain: manifest.module -> dist/index.esm.js -> dist/chunk-DzXCJ6sS.js -> dist/chunk-CcG5KOnW.js
L6: import ReactDOM, { createPortal } from "react-dom";
L7: import { useConnect, useAccount, useSwitchChain, useSendTransaction, useWaitForTransactionReceipt, WagmiProvider, useDisconnect } from "wagmi";
L8: import { QueryClientProvider, QueryClient } from "@tanstack/react-query";
...
L30: };
L31: const smallLogo = "data:image/png;base64,[redacted]...
L32: const rpcTransactionType = {
...
L375: default: {
L376: http: ["https://api.mainnet.abs.xyz"],
L377: webSocket: ["wss://api.mainnet.abs.xyz/ws"]
...
L5393: // It's faster, but should only be used when you don't care about
L5394: // an exposed private key e.g. sig verification.
L5395: // Does NOT allow scalars higher than CURV
Findings
2 Critical2 High4 Medium5 Low
CriticalCredential Exfiltrationdist/chunk-CcG5KOnW.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-CcG5KOnW.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-CcG5KOnW.js
HighSemantic Analysis Limiteddist/chunk-DzXCJ6sS.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/stablezact-vanilla.min.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to stablezact-pay@0.73.8.
See all versions of stablezact-pay for other recorded verdicts.
- Review the evidence and your use of stablezact-pay@0.73.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.