@zerohash-sdk/crypto-deposits-react@0.5.12
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends runtime diagnostics to its vendor when SDK loading fails, including the embedding page origin and browser user agent. This is undisclosed telemetry without an exposed opt-out, so it warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
The CryptoDeposits component mounts and the web-component script fails to load.
Impact
The vendor receives embedding-site and browser metadata without an explicit telemetry choice.
Mechanism
The package posts diagnostics, browser user agent, page origin, and selected JWT claims to a default Zero Hash Faro collector. The component does not expose a telemetry opt-out.
AI rationale
The package sends runtime diagnostics to its vendor when SDK loading fails, including the embedding page origin and browser user agent. This is undisclosed telemetry without an exposed opt-out, so it warrants a warning rather than a malicious verdict.
Evidence
dist/index.js
Network endpoints10
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The React component starts the web-component loader from an effect when mounted.
- The loader reports failures to a default collector when no custom reporter is supplied.
- The diagnostic payload includes the browser user agent and embedding page origin.
- On load failure, it reports diagnostic context and sends the payload in a JSON POST.
- It extracts participant and platform claims from the supplied JWT for the report.
Evidence against
- The manifest exposes a React component and defines no lifecycle scripts.
- The report concerns a failed SDK script load and goes to Zero Hash Faro collector endpoints.
- The package loads its crypto-deposits web component from Zero Hash CDN endpoints.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
285i(() => (h(!1), _({
webComponentTag: t,
appName: n ?? t,
appVersion: a,
scriptUrls: c,
fallbackScriptUrls: l,
collectorUrls: u ?? s,
env: d,
jwt: f,
timeoutMs: p,
onError: () => h(!0)
})), [
t,
n,
a,
c,
l,
u,
d,
f,
p,
g
]), {
loadFailed: m,
retry: r(() => v((e) => e + 1), [])
};
}, E = b("crypto-deposits-web", "
Medium
Ai Review Evidence
The React component starts the web-component loader from an effect when mounted.
dist/index.jsView on unpkg · L28590if (typeof document > "u") return p;
let _ = `${t}-script-${s}`;
if (customElements.get(t) || document.getElementById(_)) return p;
let v = u(c), y = e.report ?? ((e) => g(o && f(o, s, c), e, r)), b = !1, x = 0, S, C
Medium
Ai Review Evidence
The loader reports failures to a default collector when no custom reporter is supplied.
dist/index.jsView on unpkg · L9057userAgent: navigator.userAgent } : void 0,
page: typeof window < "u" ? { url: window.location.origin } : void 0
},
logs: [{
message: `Failed to load the script for ${e.webComponentTag} from ${e.env} environ
Medium
Findings
7 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-react@0.5.12.
See all versions of @zerohash-sdk/crypto-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-react@0.5.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.