@zerohash-sdk/fiat-deposits-react@1.13.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Deposits product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a React wrapper that dynamically loads a Zero Hash-hosted fiat-deposits web component when rendered and sends limited failure telemetry. Its manifest has no lifecycle hooks, and source inspection found no malicious installation, harvesting, persistence, or destructive behavior.
Decision evidence
public snapshot- The rendered component dynamically appends a module script from a configured Zero Hash CDN, so remote content executes only when the consumer renders it.
- On script-load failure it posts diagnostic metadata to a configured Zero Hash collector.
- The manifest exposes only the dist module and contains no lifecycle scripts.
- The remote loader is directly tied to the exported FiatDeposits React component and selects named vendor environments.
- The diagnostics contain load-failure context, browser user agent, and page origin; the code does not send the supplied JWT to the collector.
- No filesystem access, shell execution, eval-like execution, install hook, persistence, or credential harvesting code was found.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest exposes only the dist module and contains no lifecycle scripts.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-deposits-react@1.13.0.
See all versions of @zerohash-sdk/fiat-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-deposits-react@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.