@zerohash-sdk/fiat-account-link-react@1.15.12
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Account Link product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically reports widget load failures to Zero Hash collectors with browser, page-origin, and JWT-claim details. This is undisclosed runtime telemetry with no visible opt-out, so it warrants a warning rather than a publish block.
Decision evidence
public snapshot- When the widget reports a load error, the package builds a diagnostic payload containing browser user agent, page origin, and selected JWT claims.
- The package sends that payload in a POST to its configured Grafana Faro collector.
- The diagnostic report is invoked by the React component’s effect when it loads the widget; the README does not disclose telemetry or describe a way to disable it.
- The package has no lifecycle scripts; the network behavior is runtime behavior of the exported React widget.
- The collector URLs are on Zero Hash domains, and the report is tied to widget load failures.
- The package’s purpose is to integrate a hosted Fiat Account Link widget, which it loads from Zero Hash’s CDN.
Source & flagged code
5 flaggedWhen the widget reports a load error, the package builds a diagnostic payload containing browser user agent, page origin, and selected JWT claims.
dist/index.jsView on unpkg · L57The package sends that payload in a POST to its configured Grafana Faro collector.
dist/index.jsView on unpkg · L78The package sends that payload in a POST to its configured Grafana Faro collector.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-account-link-react@1.15.12.
See all versions of @zerohash-sdk/fiat-account-link-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-account-link-react@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.