@zerohash-sdk/fiat-account-link-js@1.15.8
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Account Link product.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe published entrypoint is a browser SDK whose explicit render flow loads a Zerohash account-link component. Its failure-only telemetry goes to Zerohash collectors and contains diagnostic metadata, with no inspected JWT transfer or unrelated attack behavior.
Decision evidence
public snapshot- The manifest exports the bundled browser SDK, and its declarations describe JWT authentication for the Fiat Account Link widget.
- Rendering loads the widget script from Zerohash CDN hosts; the collector is selected by environment and receives reports when script loading fails.
- Diagnostic reports contain browser and page metadata plus decoded platform claims; the inspected request body does not include the JWT itself.
- The manifest contains no lifecycle hook, and the exported SDK requires an explicit render call before loading the widget.
- The collector destinations are Zerohash environment endpoints, and the report path is tied to widget script load failures.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe manifest exports the bundled browser SDK, and its declarations describe JWT authentication for the Fiat Account Link widget.
dist/index.d.tsView on unpkg · L18The manifest exports the bundled browser SDK, and its declarations describe JWT authentication for the Fiat Account Link widget.
dist/index.d.tsFindings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-account-link-js@1.15.8.
See all versions of @zerohash-sdk/fiat-account-link-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-account-link-js@1.15.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.