@zerohash-sdk/csp-crypto-withdrawals-react@1.15.12
A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends runtime diagnostics by default when its widget fails to load, including browser and page details and selected JWT claims, without documenting an opt-out. The behavior is product-related and does not transmit the raw JWT, so this merits a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
A consuming app renders the component and its embedded widget encounters a network error, timeout, or failure to define its custom element.
Impact
The vendor collector receives contextual information about the user's browser, page, and participant or platform, creating a privacy concern that warrants warning; the raw JWT is not included in this report.
Mechanism
The error handler builds a Faro report from app details, selected JWT claims, browser user agent, page origin, and load failure context, then POSTs JSON to a configured collector. No telemetry opt-out is exposed by this wrapper.
AI rationale
The package sends runtime diagnostics by default when its widget fails to load, including browser and page details and selected JWT claims, without documenting an opt-out. The behavior is product-related and does not transmit the raw JWT, so this merits a warning rather than a malicious verdict.
Evidence
dist/index.jspackage.json
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the widget loader reports an error, timeout, or missing custom element, it invokes the reporting callback.
- The diagnostic payload includes app and environment metadata, JWT claims such as participant and platform codes, browser user agent, and page origin.
- The package posts those diagnostics to configured Grafana Faro collector endpoints; the component supplies default collector URLs.
- The manifest exposes the React component entry point and contains no install lifecycle script.
Evidence against
- The telemetry is limited to widget loading failures rather than being sent on package import.
- The package is a React wrapper for the Zero Hash crypto withdrawals product, and its vendor-hosted component and diagnostic collector serve that stated purpose.
- The source sends decoded JWT claims in diagnostics, not the raw JWT itself.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
107y(l);
let u = i ? void 0 : d(a ?? {}, s, c);
if (u && u !== r) {
T(u, !0);
return;
}
b = !0, C(), document.getElementById(_)?.remove(), h?.(l);
}
Medium
Ai Review Evidence
When the widget loader reports an error, timeout, or missing custom element, it invokes the reporting callback.
dist/index.jsView on unpkg · L10743lThis.__ZH_WEB_SDK_VERSION__, i = {};
return e.claims.participantCode && (i.participant_code = e.claims.participantCode), e.claims.platformName && (i.platform_name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region), r && (i.zh_web_sdk_version = r), {
sessionId: n,
payload: {
meta: {
app: {
name: e.appName,
version: t ?? "unknown",
environment: e.env
},
session: {
id: n,
attributes: i
},
browser: typeof navigator < "u" ? { userAgent: navigator.userAgent
Medium
Ai Review Evidence
The diagnostic payload includes app and environment metadata, JWT claims such as participant and platform codes, browser user agent, and page origin.
dist/index.jsView on unpkg · L4378fetch(e, {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-faro-session-id": r
},
body: JSON.stringify(i),
keepalive: !0
}).catch(() => void 0);
} catch {}
}, _ = (e)
Findings
6 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumSuspicious Lifecycle Evidencepackage.json
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12.
See all versions of @zerohash-sdk/csp-crypto-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-react@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.