registry / @zerohash-sdk/fiat-account-link-js / 1.13.3

@zerohash-sdk/fiat-account-link-js@1.13.3

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Account Link product.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a browser account-link SDK with no install-time execution or local-system capabilities. Its dynamic CDN loading and failure telemetry are package-aligned and require an explicit render call.

Static reason

No blocking static signals were detected.

Trigger

A consumer constructs the SDK and calls render on a browser element.

Impact

The consumer page loads a fixed vendor-hosted widget; failed loads send limited diagnostic metadata.

Mechanism

User-invoked remote widget loading with failure telemetry.

AI rationale

This is a browser account-link SDK with no install-time execution or local-system capabilities. Its dynamic CDN loading and failure telemetry are package-aligned and require an explicit render call.

Network endpoints11

grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes only browser distribution entrypoints and declares no lifecycle scripts.
Calling render invokes a loader that injects a module script from fixed Zerohash CDN environment URLs.
On widget-load failure, the SDK posts diagnostic metadata to Zerohash Faro collector hosts.
The inspected type declaration describes the same user-invoked web-component loader and failure reporting path.

Evidence against

No install hooks, self-dependency, shell execution, filesystem access, or credential harvesting were found.
Network activity is limited to the advertised widget CDN and failure telemetry, activated by rendering the SDK.
The telemetry decodes selected JWT claims but does not transmit the JWT token itself.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.2 KB of source, external domains: grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

6 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

204private async loadScript() { // When the element is already defined or another instance's script tag is // in flight, defer to waitForWebComponent — the shared loader would no-op // for those cases and never settle this promise. if (this.getWebComponent() || this.isScriptLoaded()) { return; } if (this.scriptLoadingPromise) { return this.scriptLoadingPromise; } // The shared loader also reports failures to Faro (with JWT claims for // partner/participant context) and removes a failed …

Low

Ai Review Evidence

The inspected type declaration describes the same user-invoked web-component loader and failure reporting path.

dist/index.d.tsView on unpkg · L204

package.jsonView file

Findings

1 High1 Medium6 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/index.d.ts

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/fiat-account-link-js@1.13.3.

See all versions of @zerohash-sdk/fiat-account-link-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/fiat-account-link-js@1.13.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 23:33:15.643Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zerohash-sdk/fiat-account-link-js / 1.13.3

@zerohash-sdk/fiat-account-link-js@1.13.3

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Account Link product.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a browser account-link SDK with no install-time execution or local-system capabilities. Its dynamic CDN loading and failure telemetry are package-aligned and require an explicit render call.

Static reason

No blocking static signals were detected.

Trigger

A consumer constructs the SDK and calls render on a browser element.

Impact

The consumer page loads a fixed vendor-hosted widget; failed loads send limited diagnostic metadata.

Mechanism

User-invoked remote widget loading with failure telemetry.

AI rationale

This is a browser account-link SDK with no install-time execution or local-system capabilities. Its dynamic CDN loading and failure telemetry are package-aligned and require an explicit render call.

Network endpoints11

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes only browser distribution entrypoints and declares no lifecycle scripts.
Calling render invokes a loader that injects a module script from fixed Zerohash CDN environment URLs.
On widget-load failure, the SDK posts diagnostic metadata to Zerohash Faro collector hosts.
The inspected type declaration describes the same user-invoked web-component loader and failure reporting path.

Evidence against

No install hooks, self-dependency, shell execution, filesystem access, or credential harvesting were found.
Network activity is limited to the advertised widget CDN and failure telemetry, activated by rendering the SDK.
The telemetry decodes selected JWT claims but does not transmit the JWT token itself.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

Low

Ai Review Evidence

The inspected type declaration describes the same user-invoked web-component loader and failure reporting path.

dist/index.d.tsView on unpkg · L204

package.jsonView file

Findings

1 High1 Medium6 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

LowAi Review Evidencedist/index.d.ts

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/fiat-account-link-js@1.13.3.

See all versions of @zerohash-sdk/fiat-account-link-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/fiat-account-link-js@1.13.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 23:33:15.643Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.