@zerohash-sdk/fiat-deposits-react@1.15.11
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Deposits product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK automatically sends undisclosed runtime failure telemetry containing browser and page metadata and selected JWT claims to Zerohash’s collector. The destination and purpose are consistent with the SDK, so this supports a telemetry warning rather than a malicious verdict.
Decision evidence
public snapshot- When the widget load fails, the handler reports the component, environment, script URL, failure reason, timing, and decoded JWT claims.
- The report payload includes the browser user agent and the page origin, along with selected participant and platform claims from the JWT.
- The failure report is sent as a JSON POST to a default Zerohash Grafana Faro collector endpoint.
- The component starts the loader in a React effect, so this reporting can occur during normal component use without a separate request.
- The package is a React SDK for loading Zerohash’s fiat-deposit widget, and the collector endpoints are Zerohash domains.
- The manifest has no lifecycle scripts and declares only React and React DOM as peer dependencies.
Source & flagged code
7 flaggedWhen the widget load fails, the handler reports the component, environment, script URL, failure reason, timing, and decoded JWT claims.
dist/index.jsView on unpkg · L94When the widget load fails, the handler reports the component, environment, script URL, failure reason, timing, and decoded JWT claims.
dist/index.jsView on unpkg · L116Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-deposits-react@1.15.11.
See all versions of @zerohash-sdk/fiat-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-deposits-react@1.15.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.