@zerohash-sdk/csp-crypto-sell-js@1.15.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect CSP Crypto Sell product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK performs first-party error reporting only when the widget fails to load, which fits its integration purpose. However, the event includes the page origin and browser user agent alongside JWT-derived claims, and the package provides no opt-out, so the runtime telemetry warrants a warning.
Decision evidence
public snapshot- Calling `render()` loads the widget script; on loading failure, timeout or missing component, the loader reports an error.
- The report includes JWT-derived participant and platform claims, plus browser user agent and the page origin.
- The report is sent by POST to environment-specific Zerohash Grafana Faro collector endpoints.
- The type declaration mentions failure reporting to Faro with JWT claims, but the README does not describe this telemetry and the SDK exposes no opt-out.
- Reporting is limited to widget script-loading failures during an explicit `render()` call.
- The collector endpoints belong to Zerohash, and the source does not show the full JWT being sent.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgCalling `render()` loads the widget script; on loading failure, timeout or missing component, the loader reports an error.
dist/index.jsView on unpkg · L142Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-sell-js@1.15.12.
See all versions of @zerohash-sdk/csp-crypto-sell-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-sell-js@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.