registry / @zerohash-sdk/csp-crypto-withdrawals-react / 1.15.4

@zerohash-sdk/csp-crypto-withdrawals-react@1.15.4

A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The manifest exposes a React library entrypoint and has no lifecycle scripts. The inspected network behavior sends diagnostic JSON to configured ZeroHash collector endpoints, with no concrete attack surface established.

Static reason

No blocking static signals were detected.

Trigger

A web component load or network failure invokes the report callback.

Impact

Diagnostic data is sent to the selected collector; inspected code does not establish credential theft or another attack.

Mechanism

The callback posts a JSON report to the selected collector URL; a caller-supplied report callback can replace the default.

AI rationale

Network endpoints3

grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collect

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points consumers to dist/index.js and declares no lifecycle scripts.
The reporting helper POSTs JSON to the selected collector endpoint.
Reports use the supplied collector configuration by default; no attack behavior was identified in the inspected paths.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.34 KB of source, external domains: grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

4 flagged

package.jsonView file

1{ "name": "@zerohash-sdk/csp-crypto-withdrawals-react", "version": "1.15.4", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "expo

Low

Suspicious Lifecycle Evidence

package.json points consumers to dist/index.js and declares no lifecycle scripts.

package.jsonView on unpkg · L1

dist/index.jsView file

83{ fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(a), keepalive: !0 }).catch(() => { }); } catch { } }, Z

Low

Ai Review Evidence

The reporting helper POSTs JSON to the selected collector endpoint.

dist/index.jsView on unpkg · L83

100const S = H(i), C = e.report ?? ((p) => K(c && P(c, n, i), p, r)); let m = !1, x = 0, k; const R = () => { k !== void 0 && clearTimeout(k); }, v = (p, y, l) => { if (m) return; const W =

Findings

1 Medium5 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/csp-crypto-withdrawals-react@1.15.4.

See all versions of @zerohash-sdk/csp-crypto-withdrawals-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-react@1.15.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 09:05:05.834Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zerohash-sdk/csp-crypto-withdrawals-react / 1.15.4

@zerohash-sdk/csp-crypto-withdrawals-react@1.15.4

A React SDK that enables frontend React applications to seamlessly integrate with the Connect CSP Crypto Withdrawals product.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A web component load or network failure invokes the report callback.

Impact

Diagnostic data is sent to the selected collector; inspected code does not establish credential theft or another attack.

Mechanism

The callback posts a JSON report to the selected collector URL; a caller-supplied report callback can replace the default.

AI rationale

Network endpoints3

grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collect

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points consumers to dist/index.js and declares no lifecycle scripts.
The reporting helper POSTs JSON to the selected collector endpoint.
Reports use the supplied collector configuration by default; no attack behavior was identified in the inspected paths.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

package.jsonView file

Low

Suspicious Lifecycle Evidence

package.json points consumers to dist/index.js and declares no lifecycle scripts.

package.jsonView on unpkg · L1

dist/index.jsView file

83{ fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(a), keepalive: !0 }).catch(() => { }); } catch { } }, Z

Low

Ai Review Evidence

The reporting helper POSTs JSON to the selected collector endpoint.

dist/index.jsView on unpkg · L83

100const S = H(i), C = e.report ?? ((p) => K(c && P(c, n, i), p, r)); let m = !1, x = 0, k; const R = () => { k !== void 0 && clearTimeout(k); }, v = (p, y, l) => { if (m) return; const W =

Findings

1 Medium5 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/csp-crypto-withdrawals-react@1.15.4.

See all versions of @zerohash-sdk/csp-crypto-withdrawals-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/csp-crypto-withdrawals-react@1.15.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 09:05:05.834Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.