@zerohash-sdk/fiat-deposits-react@1.15.5
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Deposits product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package entrypoint and inspected runtime behavior match a React wrapper for Zerohash’s fiat-deposits web component, including environment-specific remote loading and failure telemetry. The network activity is tied to the package’s stated function and no concrete attack surface was found.
Decision evidence
public snapshot- package.json exposes dist/index.js as the package entrypoint and declares no lifecycle scripts.
- The React component passes its caller-provided JWT and environment to the loader, which loads the fiat-deposits web component from Zerohash CDN hosts.
- On load failure, the package posts diagnostic context to Zerohash Grafana Faro collectors; the inspected payload contains app, page-origin, browser, and loader-error metadata.
- No credential harvesting, unrelated endpoint forwarding, install-time mutation, or other concrete attack behavior was identified in the inspected source.
Source & flagged code
6 flaggedpackage.json exposes dist/index.js as the package entrypoint and declares no lifecycle scripts.
package.jsonView on unpkg · L5The React component passes its caller-provided JWT and environment to the loader, which loads the fiat-deposits web component from Zerohash CDN hosts.
dist/index.jsView on unpkg · L311Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-deposits-react@1.15.5.
See all versions of @zerohash-sdk/fiat-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-deposits-react@1.15.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.