registry / @zerohash-sdk/fiat-deposits-react / 1.15.7
@zerohash-sdk/fiat-deposits-react@1.15.7
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fiat Deposits product.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected entrypoint loads a ZeroHash-hosted fiat-deposits widget and sends limited failure diagnostics to ZeroHash telemetry endpoints. These behaviors are package-aligned, and the source inspection found no concrete attack surface.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the FiatDeposits component; failure telemetry is triggered by a widget script load error or timeout.
Impact
The intended widget loads, and failure diagnostics include app, browser, page-origin, and script-error details; no credential theft or unrelated account action was identified.
Mechanism
The component loads an environment-specific module and passes it the supplied JWT. On loader failure, the bundle posts diagnostic JSON to the configured ZeroHash collector.
AI rationale
The inspected entrypoint loads a ZeroHash-hosted fiat-deposits widget and sends limited failure diagnostics to ZeroHash telemetry endpoints. These behaviors are package-aligned, and the source inspection found no concrete attack surface.
Evidence
package.jsondist/index.js
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the package entrypoint to dist/index.js and declares React as a peer dependency.
- The bundle selects environment-specific ZeroHash CDN URLs for the fiat-deposits web component.
- The React component loads the web component as a module and passes it the caller-provided JWT.
- The bundle reports script-load failures and sends JSON containing app, browser, page, and failure details to environment-specific telemetry collectors.
- The inspected source establishes no attack behavior; the network requests support the widget loader and its failure reporting.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
6"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports
Low
Suspicious Dependency Evidence
The manifest points the package entrypoint to dist/index.js and declares React as a peer dependency.
package.jsonView on unpkg · L6dist/index.jsView file
148dev: "https://sdk-cdn.dev.0hash.com",
cert: "https://sdk-cdn.cert.zerohash.com",
prod: "https://sdk-cdn.zerohash.com",
"eu-cert": "https://sdk-cdn.cert.zerohash.eu",
"eu-prod": "https://sdk-cdn.zerohash.eu"
}, y = "https://sdk-cdn.gating.0hash.com", b = (e, t, n = {}) => {
let { eu: r = !1, leg
Low
Ai Review Evidence
The bundle selects environment-specific ZeroHash CDN URLs for the fiat-deposits web component.
dist/index.jsView on unpkg · L148311E = b("fiat-deposits-web", "index.js", { eu: !0 }), D = "zerohash-fiat-deposits", O = ({ jwt: t, env: r = "prod", theme: i, onCompleted: o, onError: s, onClose: c, onLoaded: l, onEvent: u, ...d }) => {
let f = a(null);
Findings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fiat-deposits-react@1.15.7.
See all versions of @zerohash-sdk/fiat-deposits-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fiat-deposits-react@1.15.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.