registry / @zerohash-sdk/crypto-buy-js / 1.20.0
@zerohash-sdk/crypto-buy-js@1.20.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Buy product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found a package with no lifecycle scripts and a browser SDK whose external requests support loading its Zerohash widget and reporting load failures. No concrete attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls the SDK rendering or script-loading API in a browser.
Impact
The package-aligned behavior supports the widget and reports loading failures; no confirmed malicious impact was found.
Mechanism
The SDK selects a CDN and collector based on environment and JWT region, loads the widget script, and posts failure telemetry containing browser and page metadata.
AI rationale
Source inspection found a package with no lifecycle scripts and a browser SDK whose external requests support loading its Zerohash widget and reporting load failures. No concrete attack behavior was identified.
Evidence
dist/index.js
Network endpoints11
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares dist/index.js as the import entrypoint and has no lifecycle scripts.
- dist/index.d.ts exposes SDK configuration types; its API describes a JWT supplied by the caller.
- dist/index.js selects telemetry collectors by environment and derives regional claims from the supplied JWT.
- The runtime loads the web component from Zerohash CDN URLs when loadScript runs, and passes the selected collector and JWT into that flow.
- Telemetry posts load-failure information, including browser user agent and page origin, to configured Zerohash collectors.
Evidence against
- No package-controlled unrelated endpoint, credential harvesting, or install-time execution was identified.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg57declare abstract class BaseJsSdk<Config extends BaseConfig<never> = BaseConfig> {
private config: Config;
private state: SdkState;
private scriptLoadingPromise?
Low
Ai Review Evidence
dist/index.d.ts exposes SDK configuration types; its API describes a JWT supplied by the caller.
dist/index.d.tsView on unpkg · L57package.jsonView file
1{
"name": "@zerohash-sdk/crypto-buy-js",
"version": "1.20.0",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-buy-js@1.20.0.
See all versions of @zerohash-sdk/crypto-buy-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-buy-js@1.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.