registry / Telemetry / @zerohash-sdk/crypto-sell-react

@zerohash-sdk/crypto-sell-react

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Sell product.

This report shows the evidence for @zerohash-sdk/crypto-sell-react@1.15.12. 0 of 20 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package’s main behavior fits its stated purpose, but it silently sends browser user-agent and page-origin data to ZeroHash’s collector when the widget fails to load. This undisclosed runtime telemetry warrants a warning.

Static reason

No blocking static signals were detected.

Trigger

The React widget is mounted and its remote script fails to load or define the expected component.

Impact

ZeroHash receives information about the browser and application page during widget load failures.

Mechanism

The package posts a failure report containing app and environment metadata, browser user agent, page origin, script URL and error details.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints10

grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exports dist/index.js and declares no install lifecycle scripts.
On widget load failures, it builds a report containing app metadata, browser user agent and page origin.
The failure report includes script URL, failure reason, fallback status and elapsed time.
It sends the report by POST to the configured Faro collector.
The collector URLs belong to ZeroHash, and the widget scripts load from ZeroHash CDN hosts.

Evidence against

The package is described as a React SDK for embedding ZeroHash’s Crypto Sell product.
Reporting is tied to loading the widget and handles errors such as network failures, rather than running at package import.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 10.3 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

7 flagged

package.jsonView file

1{ "name": "@zerohash-sdk/crypto-sell-react", "version": "1.15.12", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "exports": { "./package.json":

Medium

Suspicious Lifecycle Evidence

The package exports dist/index.js and declares no install lifecycle scripts.

package.jsonView on unpkg · L1

dist/index.jsView file

49Name, version: t ?? "unknown", environment: e.env }, session: { id: n, attributes: i }, browser: typeof navigator < "u" ? { userAgent: navigator.userAgent

Medium

Ai Review Evidence

On widget load failures, it builds a report containing app metadata, browser user agent and page origin.

dist/index.jsView on unpkg · L49

57rowser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: window.location.origin } : void 0 }, logs: [{ message

Findings

8 Medium1 Low

MediumNetwork

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/index.js

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/crypto-sell-react@1.15.12.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @zerohash-sdk/crypto-sell-react@1.15.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:25:19.749Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

20 known versions

1.15.12latestshownSuspiciousTelemetryWarnPublishedOct 30, 2026, 3:00 PM 1.15.11SuspiciousTelemetryWarnPublishedOct 27, 2026, 1:59 PM 1.15.10SuspiciousTelemetryWarnPublishedOct 26, 2026, 2:06 PM 1.15.9Clean—AllowPublished

registry / Telemetry / @zerohash-sdk/crypto-sell-react

@zerohash-sdk/crypto-sell-react

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Sell product.

This report shows the evidence for @zerohash-sdk/crypto-sell-react@1.15.12. 0 of 20 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The React widget is mounted and its remote script fails to load or define the expected component.

Impact

ZeroHash receives information about the browser and application page during widget load failures.

Mechanism

The package posts a failure report containing app and environment metadata, browser user agent, page origin, script URL and error details.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints10

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exports dist/index.js and declares no install lifecycle scripts.
On widget load failures, it builds a report containing app metadata, browser user agent and page origin.
The failure report includes script URL, failure reason, fallback status and elapsed time.
It sends the report by POST to the configured Faro collector.
The collector URLs belong to ZeroHash, and the widget scripts load from ZeroHash CDN hosts.

Evidence against

The package is described as a React SDK for embedding ZeroHash’s Crypto Sell product.
Reporting is tied to loading the widget and handles errors such as network failures, rather than running at package import.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

package.jsonView file

Medium

Suspicious Lifecycle Evidence

The package exports dist/index.js and declares no install lifecycle scripts.

package.jsonView on unpkg · L1

dist/index.jsView file

49Name, version: t ?? "unknown", environment: e.env }, session: { id: n, attributes: i }, browser: typeof navigator < "u" ? { userAgent: navigator.userAgent

Medium

Ai Review Evidence

On widget load failures, it builds a report containing app metadata, browser user agent and page origin.

dist/index.jsView on unpkg · L49

57rowser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: window.location.origin } : void 0 }, logs: [{ message

Findings

8 Medium1 Low

MediumNetwork

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/index.js

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/crypto-sell-react@1.15.12.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @zerohash-sdk/crypto-sell-react@1.15.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:25:19.749Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

20 known versions