registry / @zerohash-sdk/crypto-deposits-react / 0.5.4
@zerohash-sdk/crypto-deposits-react@0.5.4
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected network behavior is conditional SDK telemetry for component load failures, sent to fixed vendor collector hosts. The package has no install lifecycle hook, and the reviewed code showed no credential exfiltration or unrelated network destination.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the component and a component script fails to load.
Impact
The collector receives app and browser metadata, page origin, and component failure details; no credential forwarding or unrelated destination was identified.
Mechanism
The bundle posts structured failure telemetry to the environment-selected collector and loads scripts from configured ZeroHash CDN hosts.
AI rationale
The inspected network behavior is conditional SDK telemetry for component load failures, sent to fixed vendor collector hosts. The package has no install lifecycle hook, and the reviewed code showed no credential exfiltration or unrelated network destination.
Evidence
dist/index.js
Network endpoints11
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as its module entrypoint and contains no lifecycle script.
- The bundle reports failed component script loads to a configured collector and sends JSON by POST.
- Telemetry includes app metadata, browser user agent, page origin, component details, and selected claims.
- Collector and component script hosts in the inspected code are ZeroHash domains.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import":
Low
Suspicious Lifecycle Evidence
package.json exposes dist/index.js as its module entrypoint and contains no lifecycle script.
package.jsonView on unpkg · L5dist/index.jsView file
97-script-${n}`;
if (customElements.get(t) || document.getElementById(p))
return x;
const R = H(c), C = e.report ?? ((u) => K(s && P(s, n, c), u, r));
let g = !1, T = 0, k;
const S = () => {
k !== void 0 && clearTimeout(k);
}, v = (u, y, l) => {
if (g)
return;
const U = Math.round(performance.now() - T), E = {
webComponentTag: t,
appName: o,
env: n,
scriptUrl: y,
reason: u,
triedFa
Low
Ai Review Evidence
The bundle reports failed component script loads to a configured collector and sends JSON by POST.
dist/index.jsView on unpkg · L97Findings
1 Medium6 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-react@0.5.4.
See all versions of @zerohash-sdk/crypto-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-react@0.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.