@zerohash-sdk/crypto-buy-react@1.21.8
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Buy product.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the runtime network activity inspected supports loading the Zerohash widget and reporting its load failures. The inspected source provides no concrete evidence of credential theft, unrelated data collection, or other attack behavior.
Decision evidence
public snapshot- The manifest points to dist/index.js as the package entry point and declares no lifecycle scripts.
- The exported CryptoBuy component loads the Zerohash crypto-buy web component from environment-specific Zerohash CDN URLs when rendered.
- The diagnostic payload contains browser origin, user agent, and web-component load details.
- The diagnostic sender posts that payload to environment-specific Zerohash collector URLs.
- The inspected network behavior is package-aligned widget loading and error reporting; no concrete attack behavior was identified.
Source & flagged code
8 flaggedThe manifest points to dist/index.js as the package entry point and declares no lifecycle scripts.
package.jsonView on unpkg · L2The exported CryptoBuy component loads the Zerohash crypto-buy web component from environment-specific Zerohash CDN URLs when rendered.
dist/index.jsView on unpkg · L309Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-buy-react@1.21.8.
See all versions of @zerohash-sdk/crypto-buy-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-buy-react@1.21.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.