registry / @zerohash-sdk/csp-crypto-sell-react / 1.15.9
@zerohash-sdk/csp-crypto-sell-react@1.15.9
A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Sell product.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest points to the inspected bundle and has no lifecycle hook. Its telemetry is triggered by component load failures and goes to environment-specific ZeroHash collectors with diagnostic metadata, consistent with the SDK’s component-loading function; no attack surface was established.
Static reason
No blocking static signals were detected.
Trigger
The React component attempts to load its web component and reports a load failure.
Impact
The collector receives diagnostic and browser context; no concrete malicious behavior was established.
Mechanism
It posts app and environment details, browser user agent, page origin, and selected JWT claims to the environment-matched collector.
AI rationale
The manifest points to the inspected bundle and has no lifecycle hook. Its telemetry is triggered by component load failures and goes to environment-specific ZeroHash collectors with diagnostic metadata, consistent with the SDK’s component-loading function; no attack surface was established.
Evidence
package.jsondist/index.js
Network endpoints5
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the runtime entrypoint and contains no lifecycle script.
- dist/index.js sends failed component-load diagnostics to environment-specific ZeroHash collector endpoints.
- The diagnostic body contains app, environment, browser, page-origin, and selected JWT claim metadata; it does not include the raw JWT in the shown payload.
- The POST is triggered by a web-component load failure, and the exported component defaults to the production environment.
Evidence against
- Failure reporting sends browser and page-origin metadata along with app and selected JWT claim metadata to the configured collector.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/csp-crypto-sell-react",
"version": "1.15.9",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "csp-crypto-sell-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
package.json exposes dist/index.js as the runtime entrypoint and contains no lifecycle script.
package.jsonView on unpkg · L1dist/index.jsView file
4var s = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collector.zerohash.com/collect",
"eu-cert": "https://grafana-faro-collector.cert.zerohash.eu/collect",
"eu-prod": "https://grafana-faro-collector.zerohash.eu/collect",
sandbox: "https://gra
Low
Ai Review Evidence
dist/index.js sends failed component-load diagnostics to environment-specific ZeroHash collector endpoints.
Findings
1 Medium7 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-sell-react@1.15.9.
See all versions of @zerohash-sdk/csp-crypto-sell-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-sell-react@1.15.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.