@zerohash-sdk/csp-fiat-withdrawals-react@0.13.11
A React SDK for embedding the Zerohash CSP Fiat Withdrawals flow into web applications. Lets users withdraw fiat (USD) from their account to a linked bank account via ACH.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe component automatically reports script-load failures to Zerohash with browser, page, and JWT-claim metadata. The package documentation does not disclose this runtime telemetry or provide a way to disable it, so the behavior warrants a warning.
Static reason
No blocking static signals were detected.
Trigger
The application renders the component and its script load fails or times out.
Impact
Zerohash receives browser, page-origin, app, and participant/platform metadata without documented disclosure or an opt-out.
Mechanism
The failure handler posts an error report to an environment-specific Zerohash Grafana collector. The report includes browser and page metadata and selected JWT claims.
AI rationale
The component automatically reports script-load failures to Zerohash with browser, page, and JWT-claim metadata. The package documentation does not disclose this runtime telemetry or provide a way to disable it, so the behavior warrants a warning.
Evidence
dist/index.jsREADME.md
Network endpoints5
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- On script load failure, the component sends telemetry to a default Zerohash Grafana collector.
- The telemetry includes app and environment details, browser user agent, page origin, and selected claims decoded from the JWT.
- Rendering the component starts the script-loading effect; failures trigger the report automatically.
- The README documents the JWT and component props but does not disclose this telemetry or provide an opt-out.
Evidence against
- The package has no lifecycle scripts; the request occurs at runtime when the component’s script load fails.
- The collector endpoints belong to Zerohash, and the report does not send the JWT token itself.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
4var s = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collec
Medium
Ai Review Evidence
On script load failure, the component sends telemetry to a default Zerohash Grafana collector.
dist/index.jsView on unpkg · L442}, h = (e, t) => {
let n = m(), r = globalThis.__ZH_WEB_SDK_VERSION__, i = {};
return e.claims.participantCode && (i.participant_code = e.claims.participantCode), e.claims.platformName && (i.platform_name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region), r && (i.zh_web_sdk_version = r), {
sessionId: n,
payload: {
meta: {
app: {
name: e.appName,
version: t ?? "unknown",
environment: e.env
},
session: {
i
Medium
Ai Review Evidence
The telemetry includes app and environment details, browser user agent, page origin, and selected claims decoded from the JWT.
dist/index.jsView on unpkg · L4274}, g = (e, t, n) => {
if (!e || typeof fetch > "u") return;
let { sessionId: r, payload: i } = h(t, n);
try {
fetch(e, {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-faro-session-id": r
},
body: JSON.stringify(i),
keepalive: !0
}).catch(() => void 0);
} catch {}
}, _ = (e) => {
let { webComponentTag: t, appName: n, appVersion: r, scriptUrls: i, fallbackScriptUrls: a, collectorUrls: o, env: s, jwt: c, timeoutMs: l = 15e3, onLoad: m, o
Findings
7 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review EvidenceREADME.md
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/csp-fiat-withdrawals-react@0.13.11.
See all versions of @zerohash-sdk/csp-fiat-withdrawals-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/csp-fiat-withdrawals-react@0.13.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.