registry / @zerohash-sdk/crypto-buy-react / 1.21.6
@zerohash-sdk/crypto-buy-react@1.21.6
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Buy product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install lifecycle behavior, and the inspected runtime is a vendor component loader with failure-only diagnostics sent to Zerohash endpoints. No concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Rendering the component loads the vendor script; a load error or timeout triggers diagnostic reporting.
Impact
The inspected code supports vendor diagnostics; no unrelated recipient or malicious effect was established.
Mechanism
The report contains app details, selected token claims, browser user agent, and page origin, and is posted to the environment-selected Zerohash collector.
AI rationale
The manifest has no install lifecycle behavior, and the inspected runtime is a vendor component loader with failure-only diagnostics sent to Zerohash endpoints. No concrete malicious behavior was found.
Evidence
package.jsondist/index.js
Network endpoints8
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to dist/index.js, ships dist, declares no lifecycle hooks, and lists React only as a peer dependency.
- The exported React wrapper loads the Zerohash crypto-buy web component for the selected environment and passes it the caller-provided JWT.
- On script load failure, the default reporter posts diagnostics to an environment-selected Zerohash collector.
- The failure diagnostics contain app and environment details, selected JWT claim fields, browser user agent, and page origin.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/crypto-buy-react",
"version": "1.21.6",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "crypto-buy-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
The manifest points to dist/index.js, ships dist, declares no lifecycle hooks, and lists React only as a peer dependency.
package.jsonView on unpkg · L1dist/index.jsView file
309: r(() => v((e) => e + 1), [])
};
}, E = b("crypto-buy-web", "index.js", { eu: !0 }), D = "zerohash-crypto-buy", O = ({ jwt: t, env: r = "prod", theme: i, filters: o, onCompleted: s, onError: c, onClose: l, onLoaded: u, onEvent: d, ...f }) => {
let p = a(null);
w(p, {
theme: i,
filters: o,
onCompleted: s,
onError: c,
onClose: l,
onLo
Low
Ai Review Evidence
The exported React wrapper loads the Zerohash crypto-buy web component for the selected environment and passes it the caller-provided JWT.
Findings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-buy-react@1.21.6.
See all versions of @zerohash-sdk/crypto-buy-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-buy-react@1.21.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.