registry / @zerohash-sdk/crypto-buy-js / 1.19.2
@zerohash-sdk/crypto-buy-js@1.19.2
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Buy product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser SDK whose user-invoked render method loads its vendor widget from fixed CDN endpoints. No install-time behavior, local harvesting, secret exfiltration, persistence, or concealed execution was found.
Static reason
No blocking static signals were detected.
Trigger
The application constructs CryptoBuy and calls render on an HTML element.
Impact
The rendered widget executes code supplied by the configured ZeroHash CDN; this is aligned with the package's browser-widget purpose.
Mechanism
Dynamic browser module loading with failure telemetry.
AI rationale
The package is a browser SDK whose user-invoked render method loads its vendor widget from fixed CDN endpoints. No install-time behavior, local harvesting, secret exfiltration, persistence, or concealed execution was found.
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts and exports only the compiled browser SDK.
- A user call to render loads a fixed ZeroHash CDN module script into the page.
- On a script-load failure, telemetry posts limited error context to fixed ZeroHash collector hosts.
- The high-scanner-hit declaration file contains SDK type declarations and no executable install behavior.
Evidence against
- No child-process, shell, filesystem, environment-harvesting, eval, or persistence code was found.
- Network activity is limited to the widget CDN and failure telemetry, activated by rendering the widget.
- The JWT is decoded only to select region and report limited partner context; the full token is not sent by this package.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg360declare class CryptoBuy extends BaseJsSdk<CryptoBuyConfig> {
protected errorMessages: {
ALREADY_RENDERED: string;
NOT_RENDERED: string;
INVALID_CONTAINER: string;
SCRIPT_LOAD_FAILED: string;
WEB_COMPONENT_NOT_DEFINED: string;
};
protected scriptUrls: Record<string, string>;
protected webComponentTag: string;
/**
* Render the CryptoBuy widget to a container element
* @param container - The container element to render the widget into
* @returns Promise that resolves when the widget is rendered
*/
…
Low
Ai Review Evidence
The high-scanner-hit declaration file contains SDK type declarations and no executable install behavior.
dist/index.d.tsView on unpkg · L360package.jsonView file
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.d.ts
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-buy-js@1.19.2.
See all versions of @zerohash-sdk/crypto-buy-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-buy-js@1.19.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.