@zerohash-sdk/crypto-buy-js@1.21.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Buy product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK reports runtime load failures to its vendor’s Faro collector, including page and browser context and claims decoded from the supplied JWT. The declarations disclose this reporting, but no opt-out is exposed, so this is a telemetry risk rather than evidence of malicious credential theft.
Decision evidence
public snapshot- The package has no lifecycle scripts and exports its JavaScript SDK from dist/index.js.
- Rendering the widget loads its configured Zerohash CDN script; failure handling sends a report to the environment’s Grafana Faro collector.
- The report includes application and environment context, decoded JWT claims, browser user agent, page origin, and script-load failure details.
- The type declarations disclose that load failures are reported to Faro with partner and participant claims; no telemetry opt-out is exposed.
- The report is limited to script-load failures during widget use, rather than running on install or import.
- The collector is a Zerohash endpoint, and the package’s documented purpose is to load Zerohash’s Crypto Buy widget.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe type declarations disclose that load failures are reported to Faro with partner and participant claims; no telemetry opt-out is exposed.
dist/index.d.tsView on unpkg · L227Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-buy-js@1.21.12.
See all versions of @zerohash-sdk/crypto-buy-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-buy-js@1.21.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.