@zerohash-sdk/crypto-sell-js@1.14.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Sell product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser widget loader, not an installer or host-side payload. Its remote loading and error telemetry are user-invoked and package-aligned, with no concrete malicious behavior in the inspected runtime source.
Decision evidence
public snapshot- The runtime loads a remote module script into the browser when the caller renders the widget.
- On a script-load failure, it sends diagnostic telemetry including browser user agent, page origin, and selected JWT claims.
- The declaration artifact contains implementation-like development override code, but the manifest selects dist/index.js as the runtime entry.
- package.json contains no lifecycle scripts or dependencies, so installation does not execute package code.
- Remote script loading is reached through render() and uses fixed Zerohash CDN URL maps for the Crypto Sell widget.
- Telemetry is limited to an error-report path; no credential harvesting, filesystem access, shell execution, or persistence is present in the runtime source.
- The high static finding path is a type declaration file rather than the selected runtime entrypoint.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declaration artifact contains implementation-like development override code, but the manifest selects dist/index.js as the runtime entry.
dist/index.d.tsView on unpkg · L202Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-sell-js@1.14.0.
See all versions of @zerohash-sdk/crypto-sell-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-sell-js@1.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.