registry / @zerohash-sdk/fiat-account-link-js / 1.15.9
@zerohash-sdk/fiat-account-link-js@1.15.9
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Account Link product.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest and declarations identify a browser widget SDK with no install hook. Its runtime network behavior is caller-invoked component loading and failure-only diagnostics to package-aligned Zerohash endpoints; no malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
The application constructs the widget and calls render; diagnostic reporting is triggered by a script load failure, timeout, or missing component.
Impact
The documented behavior supports the account-link widget and failure troubleshooting; inspected code does not send the JWT itself or expose another confirmed attack surface.
Mechanism
The loader fetches the widget from environment-specific Zerohash CDN hosts. On failure, it sends JSON containing load context and selected JWT claims to an environment- and region-matched Zerohash collector.
AI rationale
The manifest and declarations identify a browser widget SDK with no install hook. Its runtime network behavior is caller-invoked component loading and failure-only diagnostics to package-aligned Zerohash endpoints; no malicious behavior was found.
Evidence
dist/index.js
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the browser SDK entrypoint and contains no lifecycle scripts.
- The declarations describe a caller-provided JWT as widget authentication configuration.
- Calling render loads and appends the widget component.
- The component script URLs use Zerohash CDN hosts.
- Failure diagnostics include app/environment, selected JWT claims, browser user agent, page origin, and load-error context.
- The diagnostic sender posts JSON to a collector selected from the environment and JWT region.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg14* Configuration options for the SDK
*/
declare interface BaseConfig<TEvent = AppEvent> extends CommonCallbacks<TEvent> {
/**
* JWT token used for authentication. Provide/update it via `setJW
Low
Ai Review Evidence
The declarations describe a caller-provided JWT as widget authentication configuration.
dist/index.d.tsView on unpkg · L14package.jsonView file
1{
"name": "@zerohash-sdk/fiat-account-link-js",
"version": "1.15.9",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "fiat-account-link-js"
}
}
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-account-link-js@1.15.9.
See all versions of @zerohash-sdk/fiat-account-link-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-account-link-js@1.15.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.