@zerohash-sdk/csp-crypto-withdrawals-js@1.15.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiClassify as suspicious runtime telemetry: on widget load failure, the SDK sends page and JWT-derived context to Zerohash's collector without a documented opt-out. The behavior serves the SDK's error reporting and is limited to failures, so the evidence does not support a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render() and the widget script fails to load or define its component.
Impact
The vendor receives application origin and partner or participant context during load failures; this is limited to error reporting and the JWT itself is not posted.
Mechanism
The loader sends error context, browser user-agent, page origin, and selected JWT claims to Zerohash's Faro collector without a public opt-out.
AI rationale
Classify as suspicious runtime telemetry: on widget load failure, the SDK sends page and JWT-derived context to Zerohash's collector without a documented opt-out. The behavior serves the SDK's error reporting and is limited to failures, so the evidence does not support a malicious verdict.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On widget load failure, the package builds telemetry containing browser user-agent, page origin, error details, and JWT-derived participant and platform claims.
- The package POSTs this telemetry to its configured Faro collector endpoint.
- Calling render() starts the shared script loader; its failure handler invokes the telemetry reporter.
- The type declaration mentions reporting failures to Faro, but the public configuration provides no telemetry opt-out.
Evidence against
- The package is a browser SDK for loading the Zerohash CSP crypto withdrawals widget.
- The external widget script loads when the consumer calls render(), rather than on package import.
- package.json declares no lifecycle scripts.
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg227// The shared loader also reports failures to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() call can retry cleanly.
this.scriptLoadingPromise = new Promise<void>((resolve, reject) => {
loadWeb
Medium
Ai Review Evidence
The type declaration mentions reporting failures to Faro, but the public configuration provides no telemetry opt-out.
dist/index.d.tsView on unpkg · L227dist/index.jsView file
42Id: n,
payload: {
meta: {
app: {
name: e.appName,
version: t ?? "unknown",
environment: e.env
},
session: {
id: n,
attributes: i
},
browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0,
page: typeof window < "u" ? { url: window.location.origin } : void 0
},
logs: [{
message: `Failed to load the script for ${e.webComponentTag} from ${e.env} environment.`,
level: "error",
timestamp: (/* @__PURE__ */ new Date()).toISOString(),
context: {
web_component: e.webComponentTag,
Findings
1 High8 Medium1 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.d.ts
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-withdrawals-js@1.15.12.
See all versions of @zerohash-sdk/csp-crypto-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-js@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.