registry / @zerohash-sdk/csp-crypto-sell-js / 1.13.2
@zerohash-sdk/csp-crypto-sell-js@1.13.2
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect CSP Crypto Sell product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser SDK whose remote widget loading is reached only through its explicit render API. No lifecycle execution, persistence, local-data harvesting, or unconsented mutation was found.
Static reason
No blocking static signals were detected.
Trigger
A caller constructs CspCryptoSell and calls render in a browser.
Impact
The remote widget runs in the embedding page; failure telemetry includes browser and origin metadata, but this package does not harvest files, environment data, or the JWT.
Mechanism
User-invoked CDN widget loading with failure telemetry.
AI rationale
The package is a browser SDK whose remote widget loading is reached only through its explicit render API. No lifecycle execution, persistence, local-data harvesting, or unconsented mutation was found.
Network endpoints7
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The browser render path injects a module script whose URL is selected from fixed vendor CDN mappings.
- On script-load failure, it posts diagnostic telemetry including browser user agent and page origin to a vendor collector.
- The manifest exposes only built entry points and contains no lifecycle scripts.
- The type declarations expose an explicit browser render API requiring a container.
Evidence against
- No preinstall, install, postinstall, prepare, or self-dependency is present.
- Remote loading occurs only after the caller constructs the SDK and calls render.
- No filesystem, environment-variable, shell, eval, or credential-harvesting code was found.
- The telemetry payload does not include the supplied JWT.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg85/**
* Render the widget to a container element
* @param container - The container element to render the widget into
* @returns Promise that resolves when the widget is rendered
*/
async render(container: HTMLElement): Promise<void> {
Low
Ai Review Evidence
The type declarations expose an explicit browser render API requiring a container.
dist/index.d.tsView on unpkg · L85dist/index.jsView file
124const d = document.createElement("script");
d.id = h, d.src = l, d.type = "module", d.async = !0, d.onload = () => {
setTimeout(() => {
m || (customElements.get(t) ? (m = !0, f(), v?.()) : E("not-defined", l, u));
}, 0);
}, d.onerror = () => E("network", l, u), g = setTimeout(() => E("timeout", l, u), L), document.getElementById(h)?.remove(), document.head.appendChild(d);
Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-sell-js@1.13.2.
See all versions of @zerohash-sdk/csp-crypto-sell-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-sell-js@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.