@zerohash-sdk/crypto-sell-react@1.15.10
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Sell product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s widget failure handler automatically sends runtime telemetry containing page and browser context plus selected JWT claims, with no disclosure or opt-out visible in the package. This is undisclosed telemetry rather than demonstrated credential exfiltration, so it warrants a warning.
Decision evidence
public snapshot- On widget script load failure, timeout, or missing custom element, the code reports diagnostic details.
- The diagnostic payload includes selected claims decoded from the supplied JWT, including participant and platform identifiers.
- The payload also includes the browser user agent and the embedding page’s origin.
- The report is sent as a JSON POST to a Zerohash Grafana Faro collector.
- The package is a React wrapper for Zerohash’s crypto sell product, and loading its web component is central to that purpose.
- Reporting is limited to widget load failures and targets Zerohash collector endpoints; the source does not show the full JWT being sent.
Source & flagged code
6 flaggedOn widget script load failure, timeout, or missing custom element, the code reports diagnostic details.
dist/index.jsView on unpkg · L97On widget script load failure, timeout, or missing custom element, the code reports diagnostic details.
dist/index.jsView on unpkg · L119The diagnostic payload includes selected claims decoded from the supplied JWT, including participant and platform identifiers.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-sell-react@1.15.10.
See all versions of @zerohash-sdk/crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-sell-react@1.15.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.