@zerohash-sdk/crypto-sell-js@1.16.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Crypto Sell product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package has no install-time behavior or import-time network activity, but it sends undisclosed runtime telemetry when widget loading fails. The report includes page and browser context, so the appropriate verdict is suspicious telemetry.
Decision evidence
public snapshot- The runtime report includes widget app metadata and selected claims decoded from the supplied JWT.
- The report also includes the browser user agent and current page origin.
- A POST sends the report to the configured Faro collector endpoint.
- The report is triggered when loading the widget script fails or times out.
- The package exports a widget SDK and documents rendering it with an explicit call to render().
- The report is sent to Zerohash collector endpoints, and the package contains no lifecycle scripts.
- The SDK entry point does not invoke the report merely on import.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe runtime report includes widget app metadata and selected claims decoded from the supplied JWT.
dist/index.jsView on unpkg · L41Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-sell-js@1.16.12.
See all versions of @zerohash-sdk/crypto-sell-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-sell-js@1.16.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.