registry / @zerohash-sdk/csp-fiat-withdrawals-js / 0.12.2

@zerohash-sdk/csp-fiat-withdrawals-js@0.12.2

A framework-agnostic JavaScript SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a browser SDK whose network and script-loading behavior is activated by an explicit render call. Source inspection found no lifecycle hook or concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A browser consumer constructs the SDK and calls render().

Impact

The browser may fetch the configured Zerohash widget and send non-secret error context if loading fails.

Mechanism

Dynamic vendor widget loading with failure telemetry.

AI rationale

This is a browser SDK whose network and script-loading behavior is activated by an explicit render call. Source inspection found no lifecycle hook or concrete malicious behavior.

Network endpoints3

grafana-faro-collector.zerohash.comsdk-cdn.zerohash.comsdk-cdn.gating.0hash.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no lifecycle scripts and exposes only the built dist entrypoints.
The SDK loads a Zerohash-hosted web-component script only when the consumer calls render().
On a script-load failure it posts limited diagnostic telemetry to a Zerohash Faro collector.
The declaration file describes the JWT as authentication configuration, consistent with the runtime SDK interface.

Evidence against

No install-time execution, child-process use, filesystem access, eval, or persistence was found.
The remote script loader and error telemetry are explicit browser-widget behavior, not hidden import-time activity.
No package code sends the supplied JWT to the collector; it only decodes selected non-secret claims for diagnostics.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.4 KB of source, external domains: grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

5 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

25declare interface BaseConfig<TEvent = AppEvent> extends CommonCallbacks<TEvent> { /** * JWT token used for authentication. Provide/update it via `setJWT` * (`updateConfig({ jwt })`). */ jwt: string;

Low

Ai Review Evidence

The declaration file describes the JWT as authentication configuration, consistent with the runtime SDK interface.

dist/index.d.tsView on unpkg · L25

package.jsonView file

2"name": "@zerohash-sdk/csp-fiat-withdrawals-js", "version": "0.12.2", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "exports": { "./package.json": "./package.json", ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js", "require": "./dist/index.umd.js", "default": "./dist/index.js"

Findings

1 High1 Medium5 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/index.d.ts

Affected versions and remediation

This report applies to @zerohash-sdk/csp-fiat-withdrawals-js@0.12.2.

See all versions of @zerohash-sdk/csp-fiat-withdrawals-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-js@0.12.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 00:18:14.987Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zerohash-sdk/csp-fiat-withdrawals-js / 0.12.2

@zerohash-sdk/csp-fiat-withdrawals-js@0.12.2

A framework-agnostic JavaScript SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a browser SDK whose network and script-loading behavior is activated by an explicit render call. Source inspection found no lifecycle hook or concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A browser consumer constructs the SDK and calls render().

Impact

The browser may fetch the configured Zerohash widget and send non-secret error context if loading fails.

Mechanism

Dynamic vendor widget loading with failure telemetry.

AI rationale

This is a browser SDK whose network and script-loading behavior is activated by an explicit render call. Source inspection found no lifecycle hook or concrete malicious behavior.

Network endpoints3

grafana-faro-collector.zerohash.comsdk-cdn.zerohash.comsdk-cdn.gating.0hash.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no lifecycle scripts and exposes only the built dist entrypoints.
The SDK loads a Zerohash-hosted web-component script only when the consumer calls render().
On a script-load failure it posts limited diagnostic telemetry to a Zerohash Faro collector.
The declaration file describes the JWT as authentication configuration, consistent with the runtime SDK interface.

Evidence against

No install-time execution, child-process use, filesystem access, eval, or persistence was found.
The remote script loader and error telemetry are explicit browser-widget behavior, not hidden import-time activity.
No package code sends the supplied JWT to the collector; it only decodes selected non-secret claims for diagnostics.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

Low

Ai Review Evidence

The declaration file describes the JWT as authentication configuration, consistent with the runtime SDK interface.

dist/index.d.tsView on unpkg · L25

package.jsonView file

Findings

1 High1 Medium5 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/index.d.ts

Affected versions and remediation

This report applies to @zerohash-sdk/csp-fiat-withdrawals-js@0.12.2.

See all versions of @zerohash-sdk/csp-fiat-withdrawals-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-js@0.12.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 00:18:14.987Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.