registry / @zerohash-sdk/crypto-account-link-js / 1.13.2
@zerohash-sdk/crypto-account-link-js@1.13.2
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Account Link product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a browser widget loader with package-aligned CDN and telemetry endpoints, activated only by an explicit render call. Source inspection found no lifecycle hook or concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer constructs CryptoAccountLink and calls render() in a browser.
Impact
The configured remote widget runs in the host page; no package-side credential theft, filesystem mutation, or install-time behavior was found.
Mechanism
User-invoked remote web-component loading with failure telemetry.
AI rationale
This is a browser widget loader with package-aligned CDN and telemetry endpoints, activated only by an explicit render call. Source inspection found no lifecycle hook or concrete malicious behavior.
Network endpoints2
sdk-cdn.zerohash.comgrafana-faro-collector.zerohash.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Explicit browser rendering injects a module script from configured Zero Hash CDN URLs.
- On widget-load failures, the package posts telemetry to Zero Hash Grafana collector endpoints.
- The manifest contains no lifecycle scripts and exposes only compiled dist entrypoints.
- The type declarations require a JWT and browser-rendered widget configuration.
Evidence against
- No install-time execution, shell use, file access, environment harvesting, or persistence was found.
- Remote loading occurs only after the consumer explicitly calls render().
- The CDN loader and failure telemetry are consistent with this browser widget SDK's runtime role.
- Telemetry is limited to load-failure metadata, browser user agent, page origin, and JWT-derived non-secret claims; the JWT itself is not sent.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg23* Configuration options for the SDK
*/
declare interface BaseConfig<TEvent = AppEvent> extends CommonCallbacks<TEvent> {
/**
* JWT token used for authentication. Provide/update it via `setJWT`
* (`updateConfig({ jwt })`).
*/
jwt: string;
/**
* Target environment
* @default 'production'
*/
env?: Environment;
Low
Ai Review Evidence
The type declarations require a JWT and browser-rendered widget configuration.
dist/index.d.tsView on unpkg · L23dist/index.jsView file
124const d = document.createElement("script");
d.id = h, d.src = l, d.type = "module", d.async = !0, d.onload = () => {
setTimeout(() => {
m || (customElements.get(t) ? (m = !0, f(), v?.()) : E("not-defined", l, u));
}, 0);
}, d.onerror = () => E("network", l, u), g = setTimeout(() => E("timeout", l, u), O), document.getElementById(h)?.remove(), document.head.appendChild(d);
}, R = N(n, s, c);
return R ? (C(R, !1), () => {
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-account-link-js@1.13.2.
See all versions of @zerohash-sdk/crypto-account-link-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-account-link-js@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.