registry / @zerohash-sdk/crypto-deposits-js / 0.4.8
@zerohash-sdk/crypto-deposits-js@0.4.8
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe published entrypoint has no install hook and exposes a caller-invoked widget loader. Its remote script loading and failure telemetry use Zerohash’s environment-specific services, with no concrete attack surface established.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls the widget’s render method; failure telemetry is sent only if script loading fails.
Impact
This supports the SDK’s widget loading and diagnostics; the inspected source shows no unrelated recipient or concrete attack behavior.
Mechanism
The entrypoint loads the widget from a Zerohash CDN and posts a failure report containing selected JWT claims and browser context to a Zerohash collector.
AI rationale
The published entrypoint has no install hook and exposes a caller-invoked widget loader. Its remote script loading and failure telemetry use Zerohash’s environment-specific services, with no concrete attack surface established.
Evidence
package.jsondist/index.d.tsdist/index.js
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json publishes dist/index.js as the runtime entrypoint and defines no lifecycle scripts.
- dist/index.d.ts exposes a caller-invoked render method that loads the widget; the package documents the Zerohash web component.
- dist/index.js loads the widget from environment-specific Zerohash CDN hosts.
- On script-load failure, dist/index.js sends a report to the environment-specific Zerohash collector. The report includes selected JWT claims, browser user agent, and page origin.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg90async render(container: HTMLElement): Promise<void> {
// Validate container
if (!container || !(container instanceof HTMLElement)) {
throw new Error(this.errorMessages.INVALID_CONTAINER);
}
// Check if already rendered
if (this.state.initialized) {
throw new Error(this.errorMessages.ALREADY_RENDERED);
}
try {
// Ensure script is loaded
await this.ensureScriptLoaded();
// Create a
Low
Ai Review Evidence
dist/index.d.ts exposes a caller-invoked render method that loads the widget; the package documents the Zerohash web component.
dist/index.d.tsView on unpkg · L90340/**
* CryptoDeposits SDK class for programmatic control of the Connect Crypto Deposits widget.
*
* Renders the `zerohash-crypto-deposits` web component, which handles the iframe
* and postMessage communication internally.
*
* @example
* ```javascript
* const cryptoDeposits = new Cryp
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-js@0.4.8.
See all versions of @zerohash-sdk/crypto-deposits-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-js@0.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.