@zerohash-sdk/csp-crypto-sell-react@1.13.3
A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Sell product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install-time or host-level malicious behavior was found, but the package dynamically executes remote CDN code in the consumer browser. That unresolved remote-code supply-chain surface warrants a warning rather than a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders CspCryptoSell in a browser.
Impact
A compromised or changed CDN response could execute code in the host application browser; failure reports disclose limited diagnostic metadata.
Mechanism
Dynamic remote module injection and error telemetry POSTs.
AI rationale
No install-time or host-level malicious behavior was found, but the package dynamically executes remote CDN code in the consumer browser. That unresolved remote-code supply-chain surface warrants a warning rather than a clean verdict.
Evidence
dist/index.js
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package entry point is the browser-facing dist/index.js module.
- Rendering the component injects a remote module script selected from vendor CDN URLs.
- On script-load failure it posts diagnostic metadata to a vendor telemetry collector.
Evidence against
- package.json has no lifecycle scripts, bin entry, or self-dependency.
- The remote loader runs only when the exported React component is rendered.
- No filesystem access, shell execution, credential harvesting, or destructive behavior was found in the inspected files.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
Medium
Ai Review Evidence
The package entry point is the browser-facing dist/index.js module.
package.jsonView on unpkg · L5dist/index.jsView file
124}, N = (p, y) => {
R(), w = performance.now();
const l = document.createElement("script");
l.id = h, l.src = p, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
m || (customElements.get(t) ? (m = !0, R(), _?.()) : C("not-defined", p, y));
}, 0);
}, l.onerror = () => C("network", p, y), v = setTimeout(() => C("timeout", p, y), f), document.getElementById(h)?.remove(), document.head.appendChild(l);
Findings
1 High5 Medium1 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-sell-react@1.13.3.
See all versions of @zerohash-sdk/csp-crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-sell-react@1.13.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.