registry / @zerohash-sdk/crypto-deposits-react / 0.5.9
@zerohash-sdk/crypto-deposits-react@0.5.9
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe published entrypoint has no install hooks and implements a React wrapper for Zerohash’s hosted deposit component. Its failure telemetry sends diagnostic metadata to the Zerohash collector, while the supplied JWT is passed to the intended deposit component; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the component; failure diagnostics are sent if the hosted component does not load.
Impact
The inspected behavior supports the intended deposit service flow and failure diagnostics; no unrelated credential transfer or other attack was established.
Mechanism
The wrapper loads the component from environment-specific Zerohash CDN URLs, passes it the service JWT, and sends diagnostic metadata to the collector on load failure.
AI rationale
The published entrypoint has no install hooks and implements a React wrapper for Zerohash’s hosted deposit component. Its failure telemetry sends diagnostic metadata to the Zerohash collector, while the supplied JWT is passed to the intended deposit component; no concrete attack behavior was found.
Evidence
package.jsondist/index.jsdist/index.d.ts
Network endpoints5
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the runtime entrypoint and contains no lifecycle scripts or runtime dependencies beyond React peers.
- The component loads the crypto-deposits web component from Zerohash SDK CDN environment URLs when rendered.
- On script-load failure, the bundle posts diagnostic metadata, including app details, browser user agent, page origin, and selected JWT claims, to the configured collector; the request body is the diagnostic payload, not the raw JWT.
- The supplied JWT is passed to the crypto-deposits web component for its service flow.
- The public type describes the JWT as authentication for the Connect Crypto Deposits service.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/crypto-deposits-react",
"version": "0.5.9",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "crypto-deposits-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
package.json declares the runtime entrypoint and contains no lifecycle scripts or runtime dependencies beyond React peers.
package.jsonView on unpkg · L1dist/index.jsView file
147E_LOCAL_CDN_HOST || "http://localhost:5173",
dev: "https://sdk-cdn.dev.0hash.com",
cert: "https://sdk-cdn.cert.zerohash.com",
prod: "https://sdk-cdn.zerohash.com",
"eu-cert": "https://sdk-cdn.cert.zerohash.eu",
"eu-prod": "https://sdk-cdn.zerohash.eu"
},
Low
Ai Review Evidence
The component loads the crypto-deposits web component from Zerohash SDK CDN environment URLs when rendered.
Findings
1 Medium8 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.d.ts
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-deposits-react@0.5.9.
See all versions of @zerohash-sdk/crypto-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-deposits-react@0.5.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.