registry / @zerohash-sdk/crypto-deposits-js / 0.2.2
@zerohash-sdk/crypto-deposits-js@0.2.2
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser widget loader with user-invoked, vendor-aligned network behavior. It has no lifecycle hook, local system access, or concrete malicious action in the inspected source.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render on a CryptoDeposits instance.
Impact
Remote widget code executes in the embedding page; no unconsented install-time or host-level action was found.
Mechanism
Loads a Zerohash-hosted web component and sends failure telemetry.
AI rationale
The package is a browser widget loader with user-invoked, vendor-aligned network behavior. It has no lifecycle hook, local system access, or concrete malicious action in the inspected source.
Network endpoints2
sdk-cdn.zerohash.comgrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Calling render loads a remote module from a Zerohash SDK CDN.
- On script-load failure, the SDK posts limited diagnostic data to Zerohash Faro collectors.
- The flagged declaration file contains SDK type declarations, not executable code.
Evidence against
- package.json has no lifecycle scripts or dependencies.
- Remote loading occurs only after the consumer constructs the SDK and calls render.
- The inspected code has no filesystem access, shell execution, credential harvesting, or persistence.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg1/**
* Zerohash Crypto Deposits JavaScript SDK
*
* A programmatic JavaScript SDK for integrating the Crypto Deposits widget
* into web applications without requiring HTML custom elements.
*
* @packageDocumentation
*/
Low
Ai Review Evidence
The flagged declaration file contains SDK type declarations, not executable code.
dist/index.d.tsView on unpkg · L1dist/index.jsView file
122}, C = (l, u) => {
f(), y = performance.now();
const d = document.createElement("script");
d.id = h, d.src = l, d.type = "module", d.async = !0, d.onload = () => {
setTimeout(() => {
m || (customElements.get(t) ? (m = !0, f(), v?.()) : E("not-defined", l, u));
}, 0);
}, d.onerror = () => E("network", l, u), g = setTimeout(() => E("timeout", l, u), L), document.getElementById(h)?.remove(), document.head.appendChild(d);
}, R = N(n, s, c);
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-js@0.2.2.
See all versions of @zerohash-sdk/crypto-deposits-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-js@0.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.