registry / @zerohash-sdk/crypto-sell-react / 1.15.4
@zerohash-sdk/crypto-sell-react@1.15.4
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Sell product.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and source inspection shows user-render-triggered web component loading plus product-aligned failure telemetry. No concrete attack surface was established.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the React component; diagnostic POSTs occur when the embedded script fails to load or define the expected component.
Impact
The observed network activity supports loading the crypto sell UI and reporting failures; no credential harvesting or unrelated recipient was identified.
Mechanism
The module creates a script element using an environment-selected SDK CDN URL. On load failure it sends app and loading-error metadata to an environment-selected collector.
AI rationale
The manifest has no install lifecycle hooks, and source inspection shows user-render-triggered web component loading plus product-aligned failure telemetry. No concrete attack surface was established.
Evidence
package.jsondist/index.js
Network endpoints11
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a browser-oriented module entrypoint and declares no lifecycle scripts; React is a peer dependency.
- The component hook initiates loading after React effect activation, and the loader appends the selected script URL to the document.
- On load failure, the package sends diagnostic event data by POST to the configured collector endpoint; the payload contains app, session, browser/page, and script-loading error metadata.
- The script and collector hostnames are Zerohash SDK and Grafana Faro endpoints matching the package’s crypto sell SDK purpose.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
2"name": "@zerohash-sdk/crypto-sell-react",
"version": "1.15.4",
"private": false,
"type": "module",
"main": "./dist/index.js",
"
Low
Suspicious Lifecycle Evidence
The manifest points to a browser-oriented module entrypoint and declares no lifecycle scripts; React is a peer dependency.
package.jsonView on unpkg · L2dist/index.jsView file
207const { webComponentTag: t, appName: o, appVersion: r, scriptUrls: a, fallbackScriptUrls: s, collectorUrls: c, env: n, jwt: i, timeoutMs: f } = e, [b, g] = L(!1), [h, S] = L(0);
B(() => (g(!1), Z({
webComponentTag: t,
appName: o ?
Low
Ai Review Evidence
The component hook initiates loading after React effect activation, and the loader appends the selected script URL to the document.
dist/index.jsView on unpkg · L20794const { webComponentTag: t, appName: o, appVersion: r, scriptUrls: a, fallbackScriptUrls: s, collectorUrls: c, env: n, jwt: i, timeoutMs: f = 15e3, onLoad: b, onError: g } = e;
if (typeof document > "u")
return x;
const h = `${t}-sc
Findings
1 Medium7 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-sell-react@1.15.4.
See all versions of @zerohash-sdk/crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-sell-react@1.15.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.