registry / @zerohash-sdk/fiat-account-link-react / 1.15.4
@zerohash-sdk/fiat-account-link-react@1.15.4
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Account Link product.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the entrypoint's observed network behavior is browser-triggered component loading and error reporting to Zerohash endpoints. No concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the exported React component in a browser, or the hosted component load fails.
Impact
The observed network activity supports the package's account-link component and error reporting; inspected code does not establish credential theft or other malicious behavior.
Mechanism
The component appends a script element for the selected web component URL; on load failure it sends a JSON error report to the selected collector URL.
AI rationale
The manifest has no install lifecycle hooks, and the entrypoint's observed network behavior is browser-triggered component loading and error reporting to Zerohash endpoints. No concrete attack behavior was found.
Evidence
package.jsondist/index.js
Network endpoints11
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to dist/index.js and declares no lifecycle scripts.
- The exported React component starts the loader in an effect and defaults its collector URLs to the package's endpoint map.
- Failure reporting sends a JSON payload by POST only when a collector URL is present.
- The collector and web component URLs use Zerohash domains; no attack behavior was identified.
Evidence against
- The entrypoint performs network requests and loads a remote web component at runtime.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/fiat-account-link-react",
"version": "1.15.4",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
Low
Suspicious Lifecycle Evidence
package.json points to dist/index.js and declares no lifecycle scripts.
package.jsonView on unpkg · L1dist/index.jsView file
79}, K = (e, t, o) => {
if (!e || typeof fetch > "u")
return;
const { sessionId: r, payload: a } = G(t, o);
try {
fetch(e, {
method: "POST",
headers: { "Content-Type": "application/json", "x-faro-session-id": r },
body: JSON.stringify(a),
keepalive: !0
}).catch(() => {
});
} catch {
}
}, Z = (e) => {
const { webComponentTag: t, appName: o, appVersion: r, scriptUrls: a, fallbackScriptUrls: s, collectorUrls: c, env: n, jwt: i, timeoutMs: f = 15e3, onLoad: b, onError: g } = e;
if (typeof document > "u")
Low
Ai Review Evidence
Failure reporting sends a JSON payload by POST only when a collector URL is present.
dist/index.jsView on unpkg · L79Findings
1 Medium7 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-account-link-react@1.15.4.
See all versions of @zerohash-sdk/fiat-account-link-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-account-link-react@1.15.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.