registry / @zerohash-sdk/crypto-deposits-react / 0.3.1
@zerohash-sdk/crypto-deposits-react@0.3.1
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a React wrapper that deliberately loads a Zerohash-hosted crypto-deposits web component only when rendered. Its network use is product-aligned, and static inspection found no install hooks or concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the exported CryptoDeposits component in a browser.
Impact
The consumer trusts the configured Zerohash CDN content at runtime; the package does not install, persist, or modify local files.
Mechanism
User-invoked remote web-component loading with failure telemetry.
AI rationale
The package is a React wrapper that deliberately loads a Zerohash-hosted crypto-deposits web component only when rendered. Its network use is product-aligned, and static inspection found no install hooks or concrete malicious behavior.
Evidence
dist/index.js
Network endpoints10
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eugrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The React component dynamically inserts a module script from a Zerohash SDK CDN when it is rendered.
- On load failure it posts diagnostic metadata to Zerohash Grafana collector endpoints.
Evidence against
- package.json has no install lifecycle hooks, dependencies, or executable bin.
- The remote loader is invoked from the exported CryptoDeposits React component, not at package installation or import time.
- No child-process, filesystem-write, credential-harvesting, eval, or persistence code is present in the published entrypoint.
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg1{
"name": "@zerohash-sdk/crypto-deposits-react",
"version": "0.3.1",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
Low
Ai Review Evidence
The React component dynamically inserts a module script from a Zerohash SDK CDN when it is rendered.
package.jsonView on unpkg · L1dist/index.jsView file
124}, N = (u, y) => {
S(), w = performance.now();
const l = document.createElement("script");
l.id = p, l.src = u, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
g || (customElements.get(t) ? (g = !0, S(), _?.()) : C("not-defined", u, y));
}, 0);
}, l.onerror = () => C("network", u, y), v = setTimeout(() => C("timeout", u, y), h), document.getElementById(p)?.remove(), document.head.appendChild(l);
Findings
1 High1 Medium4 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-react@0.3.1.
See all versions of @zerohash-sdk/crypto-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-react@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.