registry / @zerohash-sdk/crypto-deposits-js / 0.2.3
@zerohash-sdk/crypto-deposits-js@0.2.3
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser SDK that transparently loads its named crypto-deposits web component only after consumer invocation. Its telemetry and remote widget loading are package-aligned, with no install-time execution or concrete malicious behavior in the inspected source.
Static reason
No blocking static signals were detected.
Trigger
A consumer constructs the SDK and calls render in a browser.
Impact
The host page executes the configured Zerohash widget; failure reports disclose limited browser and page metadata.
Mechanism
Browser module-script injection with failure telemetry.
AI rationale
The package is a browser SDK that transparently loads its named crypto-deposits web component only after consumer invocation. Its telemetry and remote widget loading are package-aligned, with no install-time execution or concrete malicious behavior in the inspected source.
Network endpoints11
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- On render, the SDK injects a module script from configured Zerohash CDN hosts and reports load failures to Zerohash Faro collectors.
- The manifest exposes only dist entry points and has no lifecycle-script field.
- The inspected declaration file describes a browser Crypto Deposits widget SDK and its JWT configuration.
Evidence against
- No install hooks, dependencies, shell execution, filesystem access, dynamic evaluation, or environment harvesting were found.
- The network activity is initiated by the consumer calling render and matches the package's widget-loading purpose.
- Failure telemetry contains load diagnostics, browser user agent, page origin, and selected JWT claims; no full JWT is sent by this source.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg1/**
* Zerohash Crypto Deposits JavaScript SDK
*
* A programmatic JavaScript SDK for integrating the Crypto Deposits widget
* into web applications without requiring HTML custom elements.
*
* @packageDocumentation
*/
Low
Ai Review Evidence
The inspected declaration file describes a browser Crypto Deposits widget SDK and its JWT configuration.
dist/index.d.tsView on unpkg · L1dist/index.jsView file
77}, B = (e, t, r) => {
if (!e || typeof fetch > "u")
return;
const { sessionId: o, payload: n } = $(t, r);
try {
fetch(e, {
method: "POST",
headers: { "Content-Type": "application/json", "x-faro-session-id": o },
body: JSON.stringify(n),
keepalive: !0
}).catch(() => {
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-js@0.2.3.
See all versions of @zerohash-sdk/crypto-deposits-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-js@0.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.