@zerohash-sdk/fiat-account-link-js@1.15.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Account Link product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK silently reports runtime failures to Zero Hash’s collector with page origin, browser user agent, and selected JWT claims, and the package does not disclose this reporting or document an opt-out. The behavior is limited to widget loading failures and does not show transmission of the raw JWT, so this warrants a warning rather than a publish block.
Decision evidence
public snapshot- On widget script-load failures, the SDK builds diagnostic data including the page origin, browser user agent, and selected JWT claims such as participant and platform codes.
- The SDK POSTs that diagnostic payload to a hard-coded Zero Hash Grafana Faro collector endpoint without a documented opt-out.
- The reporting callback runs on script load errors, timeouts, and component-definition failures during the widget loading flow.
- The manifest has no lifecycle scripts; the package entry point exports a widget SDK.
- The widget script is loaded when the application calls render, and its URLs point to Zero Hash SDK CDN hosts.
- The collector payload contains selected decoded JWT claims, not the raw JWT; the available source does not show the token sent to the collector.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgOn widget script-load failures, the SDK builds diagnostic data including the page origin, browser user agent, and selected JWT claims such as participant and platform codes.
dist/index.jsView on unpkg · L54Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-account-link-js@1.15.12.
See all versions of @zerohash-sdk/fiat-account-link-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-account-link-js@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.