registry / Telemetry / @zerohash-sdk/csp-crypto-withdrawals-react

@zerohash-sdk/csp-crypto-withdrawals-react

A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.

This report shows the evidence for @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12. 0 of 21 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package sends runtime diagnostics by default when its widget fails to load, including browser and page details and selected JWT claims, without documenting an opt-out. The behavior is product-related and does not transmit the raw JWT, so this merits a warning rather than a malicious verdict.

Static reason

No blocking static signals were detected.

Trigger

A consuming app renders the component and its embedded widget encounters a network error, timeout, or failure to define its custom element.

Impact

The vendor collector receives contextual information about the user's browser, page, and participant or platform, creating a privacy concern that warrants warning; the raw JWT is not included in this report.

Mechanism

The error handler builds a Faro report from app details, selected JWT claims, browser user agent, page origin, and load failure context, then POSTs JSON to a configured collector. No telemetry opt-out is exposed by this wrapper.

AI rationale

Evidence

dist/index.jspackage.json

Network endpoints5

grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

When the widget loader reports an error, timeout, or missing custom element, it invokes the reporting callback.
The diagnostic payload includes app and environment metadata, JWT claims such as participant and platform codes, browser user agent, and page origin.
The package posts those diagnostics to configured Grafana Faro collector endpoints; the component supplies default collector URLs.
The manifest exposes the React component entry point and contains no install lifecycle script.

Evidence against

The telemetry is limited to widget loading failures rather than being sent on package import.
The package is a React wrapper for the Zero Hash crypto withdrawals product, and its vendor-hosted component and diagnostic collector serve that stated purpose.
The source sends decoded JWT claims in diagnostics, not the raw JWT itself.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.jsView file

107y(l); let u = i ? void 0 : d(a ?? {}, s, c); if (u && u !== r) { T(u, !0); return; } b = !0, C(), document.getElementById(_)?.remove(), h?.(l); }

Medium

Ai Review Evidence

When the widget loader reports an error, timeout, or missing custom element, it invokes the reporting callback.

dist/index.jsView on unpkg · L107

43lThis.__ZH_WEB_SDK_VERSION__, i = {}; return e.claims.participantCode && (i.participant_code = e.claims.participantCode), e.claims.platformName && (i.platform_name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region), r && (i.zh_web_sdk_version = r), { sessionId: n, payload: { meta: { app: { name: e.appName, version: t ?? "unknown", environment: e.env }, session: { id: n, attributes: i }, browser: typeof navigator < "u" ? { userAgent: navigator.userAgent

Medium

Ai Review Evidence

The diagnostic payload includes app and environment metadata, JWT claims such as participant and platform codes, browser user agent, and page origin.

dist/index.jsView on unpkg · L43

78fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i), keepalive: !0 }).catch(() => void 0); } catch {} }, _ = (e)

Findings

6 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

MediumSuspicious Lifecycle Evidencepackage.json

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:25:22.806Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

21 known versions

1.15.12latestshownSuspiciousTelemetryWarnPublishedOct 30, 2026, 3:00 PM 1.15.11SuspiciousTelemetryWarnPublishedOct 27, 2026, 1:57 PM 1.15.10SuspiciousTelemetryWarnPublishedOct 26, 2026, 2:06 PM 1.15.9Clean—Allow

registry / Telemetry / @zerohash-sdk/csp-crypto-withdrawals-react

@zerohash-sdk/csp-crypto-withdrawals-react

A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.

This report shows the evidence for @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12. 0 of 21 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A consuming app renders the component and its embedded widget encounters a network error, timeout, or failure to define its custom element.

Impact

Mechanism

AI rationale

Evidence

dist/index.jspackage.json

Network endpoints5

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

When the widget loader reports an error, timeout, or missing custom element, it invokes the reporting callback.
The diagnostic payload includes app and environment metadata, JWT claims such as participant and platform codes, browser user agent, and page origin.
The package posts those diagnostics to configured Grafana Faro collector endpoints; the component supplies default collector URLs.
The manifest exposes the React component entry point and contains no install lifecycle script.

Evidence against

The telemetry is limited to widget loading failures rather than being sent on package import.
The package is a React wrapper for the Zero Hash crypto withdrawals product, and its vendor-hosted component and diagnostic collector serve that stated purpose.
The source sends decoded JWT claims in diagnostics, not the raw JWT itself.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.jsView file

107y(l); let u = i ? void 0 : d(a ?? {}, s, c); if (u && u !== r) { T(u, !0); return; } b = !0, C(), document.getElementById(_)?.remove(), h?.(l); }

Medium

Ai Review Evidence

When the widget loader reports an error, timeout, or missing custom element, it invokes the reporting callback.

dist/index.jsView on unpkg · L107

Medium

Ai Review Evidence

The diagnostic payload includes app and environment metadata, JWT claims such as participant and platform codes, browser user agent, and page origin.

dist/index.jsView on unpkg · L43

78fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i), keepalive: !0 }).catch(() => void 0); } catch {} }, _ = (e)

Findings

6 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

MediumSuspicious Lifecycle Evidencepackage.json

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:25:22.806Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

21 known versions