registry / @zerohash-sdk/crypto-sell-react / 1.15.7
@zerohash-sdk/crypto-sell-react@1.15.7
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Crypto Sell product.
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found no install-time behavior or malicious runtime action. Network requests are limited to loading the Zerohash crypto-sell component and sending load-failure diagnostics to Zerohash collectors.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders CryptoSell; diagnostic reporting is triggered by a component load failure.
Impact
No confirmed attack surface was established; the observed network behavior supports the documented widget-loading and failure-reporting functions.
Mechanism
The wrapper selects environment-specific Zerohash URLs, appends the component script, and posts load-error diagnostics to the corresponding collector.
AI rationale
Source inspection found no install-time behavior or malicious runtime action. Network requests are limited to loading the Zerohash crypto-sell component and sending load-failure diagnostics to Zerohash collectors.
Evidence
package.jsondist/index.js
Network endpoints10
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eugrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the React wrapper from dist/index.js and declares no lifecycle scripts or runtime dependencies.
- The component loads the crypto-sell web component for the selected environment when rendered, and passes it the caller-provided JWT.
- If loading fails, the wrapper sends an error report to an environment-specific Zerohash collector; the report contains app, browser, page-origin, and load-error context.
- The inspected report body contains diagnostic context and JWT claims, not the JWT token itself.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/crypto-sell-react",
"version": "1.15.7",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "crypto-sell-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
The manifest exports the React wrapper from dist/index.js and declares no lifecycle scripts or runtime dependencies.
package.jsonView on unpkg · L1dist/index.jsView file
323scriptUrls: E,
env: r,
jwt: t
});
return p ? /* @__PURE__ */ e(C, {
onRetry: m,
onClose: c
}) : n.createElement(D, {
ref: f,
jwt: t,
env: r,
theme: i,
...d
});
};
//#endregion
export { O as CryptoSell };
Low
Ai Review Evidence
The component loads the crypto-sell web component for the selected environment when rendered, and passes it the caller-provided JWT.
dist/index.jsFindings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/crypto-sell-react@1.15.7.
See all versions of @zerohash-sdk/crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/crypto-sell-react@1.15.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.