registry / @zerohash-sdk/csp-crypto-withdrawals-js / 1.15.6
@zerohash-sdk/csp-crypto-withdrawals-js@1.15.6
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install hooks, and the runtime’s network behavior is tied to caller-invoked widget rendering and failure reporting to Zerohash endpoints. Source inspection found no confirmed malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes render(); error reporting occurs if widget script loading fails.
Impact
The inspected code shows package-aligned widget loading and failure telemetry, with no confirmed harmful effect.
Mechanism
The runtime loads a Zerohash-hosted widget and posts a constructed load-error report to a collector selected by environment.
AI rationale
The manifest has no install hooks, and the runtime’s network behavior is tied to caller-invoked widget rendering and failure reporting to Zerohash endpoints. Source inspection found no confirmed malicious behavior.
Evidence
package.jsondist/index.jsdist/index.d.ts
Network endpoints11
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to dist/index.js and declares no install lifecycle scripts.
- The declarations show that rendering the widget triggers script loading; the caller supplies the JWT as SDK configuration.
- The runtime loads the widget from Zerohash CDN hosts. Its failure handler sends a constructed error report to environment-mapped Zerohash collectors, including decoded context claims and browser metadata.
- The manifest, declarations, and inspected runtime support an ordinary caller-invoked widget SDK; no malicious behavior was identified.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg90async render(container: HTMLElement): Promise<void> {
// Validate container
if (!container || !(container instanceof HTMLElement)) {
throw new Error(this.errorMessages.INVALID_CONTAINER);
}
// Check if already rendered
if (this.state.initialized) {
throw new Error(this.errorMessages.ALREADY_RENDERED);
}
try {
// Ensure script is loaded
await this.ensureScriptLoaded();
// Create and append the web component
const element = this.createWe
Low
Ai Review Evidence
The declarations show that rendering the widget triggers script loading; the caller supplies the JWT as SDK configuration.
dist/index.d.tsView on unpkg · L90227// The shared loader also reports failures to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() call can retry cleanly.
this.scriptLoadingPromise = new Promise<void>((resolve, reject) => {
loadWebComponentScript({
webComponentTag: this.webComponentTag,
appName: this.webComponentTag,
scriptUrls: this.getEffectiveScriptUrls()
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-withdrawals-js@1.15.6.
See all versions of @zerohash-sdk/csp-crypto-withdrawals-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-js@1.15.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.