registry / Remote code execution / @zerohash-sdk/fiat-deposits-js / 1.13.3

@zerohash-sdk/fiat-deposits-js@1.13.3

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Deposits product.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not concrete malware or an install hook, but it deliberately delegates executable code to an unpinned remote endpoint and static coverage is incomplete because dist/index.d.ts is malformed. Downgrade to a warning rather than mark clean.

Static reason

No blocking static signals were detected.

Trigger

An application constructs FiatDeposits and calls render in a browser.

Impact

A compromised or changed CDN response would execute with the embedding page's privileges; failure telemetry reveals context and JWT-derived claims.

Mechanism

Dynamic external module-script loading with failure telemetry.

AI rationale

Evidence

dist/index.jsdist/index.d.ts

Network endpoints11

sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The manifest exposes both a JavaScript runtime entry and a type entry whose contents are not declaration-only.
Calling render loads an unpinned external module script and appends it to the page head.
On script-load failure, the package posts diagnostics containing JWT-derived claims, browser user agent, and page origin.
The type file contains executable-looking implementation and a Vite URL override, leaving static analysis incomplete.

Evidence against

package.json declares no lifecycle scripts.
The runtime loader is reached from explicit browser rendering, not package installation or import.
No file-system, shell, eval, or credential-harvesting APIs were found in the inspected package files.
The observed hosts are Zerohash-branded CDN and telemetry endpoints.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.2 KB of source, external domains: grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

5 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

193private getEffectiveScriptUrls(): Record<string, string> { // Support local development with Vite: an internal build pins the script // URL for the configured env, bypassing the CDN maps entirely. if (typeof import.meta !== 'undefined' && import.meta.env?.['VITE_INTERNAL_BUILD'] === 'true') { const override = import.meta.env['VITE_SCRIPT_URL']; if (override) return { [this.getEnvironment()]: override }; } return this.scriptUrls;

Medium

Ai Review Evidence

The type file contains executable-looking implementation and a Vite URL override, leaving static analysis incomplete.

dist/index.d.tsView on unpkg · L193

package.jsonView file

Findings

1 High5 Medium1 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/index.js

MediumAi Review Evidencedist/index.d.ts

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/fiat-deposits-js@1.13.3.

See all versions of @zerohash-sdk/fiat-deposits-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/fiat-deposits-js@1.13.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 22:51:56.722Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Remote code execution / @zerohash-sdk/fiat-deposits-js / 1.13.3

@zerohash-sdk/fiat-deposits-js@1.13.3

A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fiat Deposits product.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

An application constructs FiatDeposits and calls render in a browser.

Impact

A compromised or changed CDN response would execute with the embedding page's privileges; failure telemetry reveals context and JWT-derived claims.

Mechanism

Dynamic external module-script loading with failure telemetry.

AI rationale

Evidence

dist/index.jsdist/index.d.ts

Network endpoints11

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The manifest exposes both a JavaScript runtime entry and a type entry whose contents are not declaration-only.
Calling render loads an unpinned external module script and appends it to the page head.
On script-load failure, the package posts diagnostics containing JWT-derived claims, browser user agent, and page origin.
The type file contains executable-looking implementation and a Vite URL override, leaving static analysis incomplete.

Evidence against

package.json declares no lifecycle scripts.
The runtime loader is reached from explicit browser rendering, not package installation or import.
No file-system, shell, eval, or credential-harvesting APIs were found in the inspected package files.
The observed hosts are Zerohash-branded CDN and telemetry endpoints.

Behavioral surface

Source

Network

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.d.tsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.d.tsView on unpkg

Medium

Ai Review Evidence

The type file contains executable-looking implementation and a Vite URL override, leaving static analysis incomplete.

dist/index.d.tsView on unpkg · L193

package.jsonView file

Findings

1 High5 Medium1 Low

HighSemantic Analysis Limiteddist/index.d.ts

MediumNetwork

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/index.js

MediumAi Review Evidencedist/index.d.ts

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/fiat-deposits-js@1.13.3.

See all versions of @zerohash-sdk/fiat-deposits-js for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/fiat-deposits-js@1.13.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 22:51:56.722Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.