registry / @zerohash-sdk/crypto-deposits-js / 0.4.0
@zerohash-sdk/crypto-deposits-js@0.4.0
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package manifest has no lifecycle hook, and source inspection shows a browser SDK that loads its widget and reports load errors through the SDK collector flow. No concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the SDK and invokes its widget loading or rendering flow; telemetry is sent on a reported load failure when a collector URL is available.
Impact
The inspected code does not show credential harvesting, install-time execution, or unrelated data exfiltration.
Mechanism
The loader adds the configured widget script, while error reporting posts a JSON event payload to the selected collector URL.
AI rationale
The package manifest has no lifecycle hook, and source inspection shows a browser SDK that loads its widget and reports load errors through the SDK collector flow. No concrete malicious behavior was found.
Evidence
package.jsondist/index.d.tsdist/index.js
Network endpoints2
grafana-faro-collector.zerohash.com/collectsdk-cdn.zerohash.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the bundled JavaScript as the module entrypoint and contains no lifecycle script.
- dist/index.d.ts defines a browser SDK configuration requiring a caller-provided JWT.
- dist/index.js sends error-report payloads by POST only when a collector URL is supplied, and starts loading the widget through its SDK loader.
Evidence against
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
6 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg25declare interface BaseConfig<TEvent = AppEvent> extends CommonCallbacks<TEvent> {
/**
* JWT token used for authentication. Provide/update it via `s
Low
Ai Review Evidence
dist/index.d.ts defines a browser SDK configuration requiring a caller-provided JWT.
dist/index.d.tsView on unpkg · L25package.jsonView file
5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.
Low
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-js@0.4.0.
See all versions of @zerohash-sdk/crypto-deposits-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-js@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.