registry / @zerohash-sdk/fiat-deposits-react / 1.15.6
@zerohash-sdk/fiat-deposits-react@1.15.6
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Deposits product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe package entrypoint exposes a React wrapper for its ZeroHash fiat deposits widget. Its inspected network activity loads that widget and reports limited diagnostics to ZeroHash after load failures; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Rendering the component starts widget loading; a network error, timeout, or missing widget triggers failure reporting.
Impact
No confirmed harmful effect was found; the inspected reporting path sends error diagnostics and does not include the raw JWT.
Mechanism
The bundle loads a script from the ZeroHash SDK CDN and may POST error context, including page and browser metadata and selected decoded JWT claims, to a ZeroHash Grafana collector.
AI rationale
The package entrypoint exposes a React wrapper for its ZeroHash fiat deposits widget. Its inspected network activity loads that widget and reports limited diagnostics to ZeroHash after load failures; no concrete attack behavior was found.
Evidence
package.jsondist/index.js
Network endpoints10
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points package imports to dist/index.js.
- The exported React component passes the caller-provided JWT to the ZeroHash fiat deposits web component and loads that component from ZeroHash’s SDK CDN.
- On script-load failure, the bundle reports limited diagnostic metadata, including browser and page details and selected decoded JWT claims, to a ZeroHash Grafana collector.
- The collector report is sent as a JSON POST; the inspected source shows no raw JWT in that report.
Evidence against
- The bundle does make network requests and its failure report includes page origin, browser user agent, and selected JWT claims; the report is triggered by widget loading errors and goes to the configured ZeroHash collector.
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
6"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.
Low
Ai Review Evidence
package.json points package imports to dist/index.js.
package.jsonView on unpkg · L6dist/index.jsView file
322bComponentTag: D,
scriptUrls: E,
env: r,
jwt: t
});
return p ? /* @__PURE__ */ e(C, {
onRetry: m,
onClose: c
}) : n.createElement(D, {
ref: f,
jwt: t,
env: r,
theme: i,
...d
});
};
//#endregion
export { O as FiatDeposits
Low
Ai Review Evidence
The exported React component passes the caller-provided JWT to the ZeroHash fiat deposits web component and loads that component from ZeroHash’s SDK CDN.
dist/index.jsView on unpkg · L322146[redacted]"
}.VITE_LOCAL_CDN_HOST || "http://localhost:5173",
dev: "https://sdk-cdn.dev.0hash.com",
cert: "https://sdk-cdn.cert.zerohash.com",
prod: "https://sdk-cdn.zerohash.com",
"eu-cert": "https://sdk-cdn.cert.zerohash.eu",
"eu-prod": "https://sdk-cdn.zerohash.eu"
},
Findings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-deposits-react@1.15.6.
See all versions of @zerohash-sdk/fiat-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-deposits-react@1.15.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.