@zerohash-sdk/fund-js@1.16.10
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe error-only telemetry is sent to the package vendor’s collector, but it includes partner/participant claims and browser/page context without a documented disable control. This is a warning-level telemetry concern, not clear malicious behavior.
Decision evidence
public snapshot- The SDK defines environment-specific endpoints on Zero Hash Grafana Faro collector hosts.
- When widget loading fails, the loader reports failure context to the collector.
- The report can include selected JWT claims, the browser user-agent, and the page origin.
- The SDK POSTs the report as JSON; its type declaration notes Faro reporting with partner/participant JWT claims, but no disable control is documented.
- The package manifest declares no lifecycle scripts.
- Reporting is reached through widget loading during an explicit render, not at import time.
- The collector hosts belong to Zero Hash, and the SDK sends selected claims rather than the raw JWT.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe SDK POSTs the report as JSON; its type declaration notes Faro reporting with partner/participant JWT claims, but no disable control is documented.
dist/index.d.tsView on unpkg · L227Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-js@1.16.10.
See all versions of @zerohash-sdk/fund-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-js@1.16.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.