registry / @zerohash-sdk/crypto-account-link-js / 1.15.8

@zerohash-sdk/crypto-account-link-js@1.15.8

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Account Link product.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The manifest has no install lifecycle hooks, and the runtime behavior is a caller-invoked widget loader with failure-only telemetry to ZeroHash endpoints. The collected report includes decoded JWT claims and browser/page metadata, but the inspected code does not send the raw JWT or establish an unrelated recipient.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls render; telemetry is sent only if the widget script fails to load.

Impact

The inspected source shows expected widget loading and package-aligned failure telemetry; it does not establish credential theft or another attack.

Mechanism

The SDK loads a module from its configured ZeroHash CDN and, on failure, posts an error report with app, browser, page-origin, session, and decoded JWT claim metadata to a ZeroHash collector.

AI rationale

Evidence

package.jsondist/index.jsdist/index.d.ts

Network endpoints2

sdk-cdn.zerohash.comgrafana-faro-collector.zerohash.com/collect

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points consumers to the reviewed JavaScript entrypoint and declaration file; it defines no lifecycle scripts.
The declarations describe a caller-supplied JWT and a widget rendered into a caller-provided container.
The SDK loads its widget script from ZeroHash CDN URLs when render is called.
On script-load failure, the SDK sends an error report to a ZeroHash Faro collector containing session, app, browser, page-origin, and decoded JWT claim metadata; it does not send the raw JWT.
The declaration file describes the SDK's callback and widget configuration surface.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.2 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

9 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

30jwt: string; /** * Target environment * @default 'production' */ env?: Environment; /** * Theme mode * @default 'light' *

Low

Ai Review Evidence

The declarations describe a caller-supplied JWT and a widget rendered into a caller-provided container.

dist/index.d.tsView on unpkg · L30

package.jsonView file

6"main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "exports": { "./package.json": "./package.json", ".": {

Findings

1 High1 Medium9 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.d.ts

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/crypto-account-link-js@1.15.8.

See all versions of @zerohash-sdk/crypto-account-link-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/crypto-account-link-js@1.15.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 19:20:04.368Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zerohash-sdk/crypto-account-link-js / 1.15.8

@zerohash-sdk/crypto-account-link-js@1.15.8

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Account Link product.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A consumer calls render; telemetry is sent only if the widget script fails to load.

Impact

The inspected source shows expected widget loading and package-aligned failure telemetry; it does not establish credential theft or another attack.

Mechanism

The SDK loads a module from its configured ZeroHash CDN and, on failure, posts an error report with app, browser, page-origin, session, and decoded JWT claim metadata to a ZeroHash collector.

AI rationale

Evidence

package.jsondist/index.jsdist/index.d.ts

Network endpoints2

sdk-cdn.zerohash.comgrafana-faro-collector.zerohash.com/collect

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points consumers to the reviewed JavaScript entrypoint and declaration file; it defines no lifecycle scripts.
The declarations describe a caller-supplied JWT and a widget rendered into a caller-provided container.
The SDK loads its widget script from ZeroHash CDN URLs when render is called.
On script-load failure, the SDK sends an error report to a ZeroHash Faro collector containing session, app, browser, page-origin, and decoded JWT claim metadata; it does not send the raw JWT.
The declaration file describes the SDK's callback and widget configuration surface.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

30jwt: string; /** * Target environment * @default 'production' */ env?: Environment; /** * Theme mode * @default 'light' *

Low

Ai Review Evidence

The declarations describe a caller-supplied JWT and a widget rendered into a caller-provided container.

dist/index.d.tsView on unpkg · L30

package.jsonView file

6"main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "exports": { "./package.json": "./package.json", ".": {

Findings

1 High1 Medium9 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.d.ts

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/crypto-account-link-js@1.15.8.

See all versions of @zerohash-sdk/crypto-account-link-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/crypto-account-link-js@1.15.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 19:20:04.368Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.