@zerohash-sdk/csp-crypto-sell-react@1.15.5
A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Sell product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found a browser-side React SDK that loads ZeroHash-hosted component scripts and reports component load failures to ZeroHash collectors. The package has no install lifecycle hook, and the inspected telemetry payload does not include the supplied JWT.
Decision evidence
public snapshot- package.json exposes a React component through dist/index.js and has no lifecycle scripts or runtime dependencies; React is a peer dependency.
- The component loads a ZeroHash crypto-sell web component from environment-specific ZeroHash CDN hosts when rendered.
- On load failure, it posts app, session, browser, page-origin, and error metadata to a selected collector; the payload shown does not include the JWT itself.
- Inspected source contains no install-time execution, credential harvesting, or unrelated external destination.
- Telemetry is associated with component loading errors and the package’s ZeroHash collector, and the loaded script is served from ZeroHash CDN hosts.
Source & flagged code
5 flaggedpackage.json exposes a React component through dist/index.js and has no lifecycle scripts or runtime dependencies; React is a peer dependency.
package.jsonView on unpkg · L2The component loads a ZeroHash crypto-sell web component from environment-specific ZeroHash CDN hosts when rendered.
dist/index.jsView on unpkg · L148Findings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-sell-react@1.15.5.
See all versions of @zerohash-sdk/csp-crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-sell-react@1.15.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.