@zerohash-sdk/fund-js@1.16.12
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package otherwise matches its documented widget SDK purpose, but it automatically sends undisclosed runtime telemetry with application and browser context on script-load failures. This warrants a warning for telemetry, not a publish block.
Static reason
No blocking static signals were detected.
Trigger
The application calls render(), and script loading then fails, times out, or does not define the expected widget.
Impact
The service receives runtime telemetry and app context without disclosure in the package documentation or a visible opt-out in the inspected code.
Mechanism
The SDK posts a report containing JWT-derived claims, user agent, page origin, and failure details to the collector selected for the configured environment.
AI rationale
The package otherwise matches its documented widget SDK purpose, but it automatically sends undisclosed runtime telemetry with application and browser context on script-load failures. This warrants a warning for telemetry, not a publish block.
Evidence
dist/index.jsREADME.mdpackage.json
Network endpoints11
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- On widget script-load failures, the SDK posts a diagnostic report to an environment-selected Zerohash Grafana Faro collector.
- The report includes JWT-derived participant and platform claims, browser user agent, the page origin, and details of the failed script load.
- The report is triggered by script-loading errors or timeouts during widget setup; the package has no lifecycle scripts.
- The package describes itself as a Fund widget SDK and documents creating and rendering a widget with a JWT.
Evidence against
- The collector and script CDN hosts are Zerohash-branded and match the package's documented service.
- The network report is limited to failed script-load diagnostics; no credential is sent to an unrelated host in the inspected source.
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgdist/index.jsView file
1var e = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collector.ze
Medium
Ai Review Evidence
On widget script-load failures, the SDK posts a diagnostic report to an environment-selected Zerohash Grafana Faro collector.
dist/index.jsView on unpkg · L140= {};
return e.claims.participantCode && (i.participant_code = e.claims.participantCode), e.claims.platformName && (i.platform_name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region), r && (i.zh_web_sdk_version = r), {
sessionId: n,
payload: {
meta: {
app: {
name: e.appName,
version: t
Findings
1 High7 Medium1 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumSuspicious Lifecycle Evidencedist/index.js
MediumAi Review EvidenceREADME.md
MediumSuspicious Lifecycle Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-js@1.16.12.
See all versions of @zerohash-sdk/fund-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-js@1.16.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.