@zerohash-sdk/csp-crypto-sell-react@1.13.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Sell product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a React wrapper that conditionally loads its associated web component from Zerohash CDN endpoints after explicit rendering. Its telemetry is limited to load-failure diagnostics, and source inspection found no malicious install-time or host-level behavior.
Decision evidence
public snapshot- The manifest exposes a browser library entry point and contains no lifecycle-script field.
- When the consumer renders the component, it dynamically injects a vendor-hosted module script.
- On widget-load failure, it posts diagnostic telemetry to a configured collector.
- No install hooks, shell commands, filesystem access, environment harvesting, or credential exfiltration are present.
- The network behavior is limited to the rendered crypto-sell widget and its failure reporting.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest exposes a browser library entry point and contains no lifecycle-script field.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-sell-react@1.13.0.
See all versions of @zerohash-sdk/csp-crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-sell-react@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.