registry / @zerohash-sdk/crypto-deposits-js / 0.4.5
@zerohash-sdk/crypto-deposits-js@0.4.5
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the inspected runtime performs user-triggered widget loading plus package-aligned failure telemetry. These network behaviors do not establish a malicious attack surface.
Static reason
No blocking static signals were detected.
Trigger
A consumer invokes the widget render flow, or its hosted script fails to load.
Impact
This supports the advertised widget behavior and diagnostic reporting; no concrete harmful effect was identified.
Mechanism
The runtime inserts an environment-specific CDN script and may POST script-load failure details to a collector.
AI rationale
The manifest has no install lifecycle hooks, and the inspected runtime performs user-triggered widget loading plus package-aligned failure telemetry. These network behaviors do not establish a malicious attack surface.
Network endpoints11
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the dist entrypoints and contains no lifecycle scripts.
- The declaration file describes a caller-provided JWT for widget authentication.
- The runtime posts failure telemetry to a collector URL and adds a generated session ID; the inspected payload contains app, page, browser, and script-load failure details.
- The widget loads its environment-specific CDN script when its render flow requests it.
Evidence against
- Inspected runtime behavior matches a browser SDK that loads its web component on use and reports script-load failures.
- No credential harvesting, unrelated data exfiltration, install-time execution, or other concrete attack behavior was identified in the inspected source.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg24*/
declare interface BaseConfig<TEvent = AppEvent> extends CommonCallbacks<TEvent> {
/**
* JWT token used for authentication. Provide/update it via `setJWT`
* (`updateConfig({ jwt })`).
*/
jwt: string;
/**
*
Low
Ai Review Evidence
The declaration file describes a caller-provided JWT for widget authentication.
dist/index.d.tsView on unpkg · L24package.jsonView file
1{
"name": "@zerohash-sdk/crypto-deposits-js",
"version": "0.4.5",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "crypto-deposits-js"
}
}
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-js@0.4.5.
See all versions of @zerohash-sdk/crypto-deposits-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-js@0.4.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.