registry / @zerohash-sdk/crypto-buy-js / 1.19.0
@zerohash-sdk/crypto-buy-js@1.19.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Buy product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a browser widget loader with explicit runtime CDN loading and narrowly scoped error telemetry. The package has no lifecycle hook or local malicious capability, and no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer constructs CryptoBuy and calls render in a browser.
Impact
The configured remote widget executes in the host page; failed loads report limited browser and page-origin diagnostics.
Mechanism
User-invoked remote widget loading with failure telemetry.
AI rationale
This is a browser widget loader with explicit runtime CDN loading and narrowly scoped error telemetry. The package has no lifecycle hook or local malicious capability, and no concrete attack behavior was found.
Evidence
dist/index.js
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Rendering dynamically inserts a module script selected from configured ZeroHash CDN URLs.
- On widget-load failure it posts diagnostic telemetry containing browser user agent, origin, and error context.
- The high-scanner path is a TypeScript declaration file containing SDK type declarations, not executable behavior.
- The manifest exposes the distribution entry point and contains no lifecycle scripts.
Evidence against
- No install hook, dependencies, bin entry, or import-time network action is present.
- Remote loading occurs only after the consumer constructs the SDK and calls render.
- No filesystem access, shell execution, environment harvesting, credential exfiltration, persistence, or destructive action was found.
- The telemetry is limited to widget-load failures and uses configured ZeroHash collector endpoints.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg1/**
* Zerohash Crypto Buy JavaScript SDK
*
* A programmatic JavaScript SDK for integrating the Crypto Buy widget
* into web applications without requiring HTML custom elements.
*
* @packageDocumentation
*/
Low
Ai Review Evidence
The high-scanner path is a TypeScript declaration file containing SDK type declarations, not executable behavior.
dist/index.d.tsView on unpkg · L1dist/index.jsView file
124const d = document.createElement("script");
d.id = h, d.src = l, d.type = "module", d.async = !0, d.onload = () => {
setTimeout(() => {
m || (customElements.get(t) ? (m = !0, f(), v?.()) : E("not-defined", l, u));
}, 0);
}, d.onerror = () => E("network", l, u), g = setTimeout(() => E("timeout", l, u), L), document.getElementById(h)?.remove(), document.head.appendChild(d);
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.d.ts
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-buy-js@1.19.0.
See all versions of @zerohash-sdk/crypto-buy-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-buy-js@1.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.