@zerohash-sdk/crypto-deposits-js@0.4.12
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK sends automatic, failure-triggered runtime telemetry to its publisher, including browser and participant context, with no apparent public opt-out. Its declarations disclose Faro reporting, so this is a warning-level telemetry concern rather than evidence of malicious exfiltration.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render(), and loading the web component script fails or times out.
Impact
Zerohash receives contextual information about the consumer's page and participant when a load failure occurs, without an apparent user-facing control to disable reporting.
Mechanism
The loader POSTs an error payload to the collector selected for the configured environment. The payload includes app and environment details, a random session ID, JWT claims, browser user agent, and page origin. No public opt-out is exposed by the SDK class.
AI rationale
The SDK sends automatic, failure-triggered runtime telemetry to its publisher, including browser and participant context, with no apparent public opt-out. Its declarations disclose Faro reporting, so this is a warning-level telemetry concern rather than evidence of malicious exfiltration.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The SDK sends error reports to environment-specific Zerohash Grafana Faro collector endpoints.
- Reports include browser user agent and the page origin.
- The report payload includes app and environment details, a random session ID, and JWT partner or participant claims.
- Reporting is triggered when the web component script fails to load; the SDK starts that load during render.
- The type declarations disclose Faro failure reporting with JWT partner or participant context.
Evidence against
- The package has no lifecycle scripts, and importing its entry point does not itself trigger the report.
- The collector is a Zerohash endpoint, and reports concern failures loading the SDK's own web component.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg227// The shared loader also reports failures to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() ca
Medium
Ai Review Evidence
The type declarations disclose Faro failure reporting with JWT partner or participant context.
dist/index.d.tsView on unpkg · L227dist/index.jsView file
1var e = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collector.zerohash.com/collect",
"eu-cert": "https://grafana-faro-collector.
Findings
1 High6 Medium1 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.d.ts
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-js@0.4.12.
See all versions of @zerohash-sdk/crypto-deposits-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-js@0.4.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.