registry / @zerohash-sdk/fund-js / 1.16.4
@zerohash-sdk/fund-js@1.16.4
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 25d ago · by lpm-firewall-aiSource inspection found a browser Fund widget SDK with Zerohash-aligned CDN and telemetry endpoints. Its report POST is part of widget setup and no concrete malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports and invokes the widget SDK in a browser; telemetry is used when the widget reports an event.
Impact
The inspected behavior supports widget loading and telemetry; it does not establish credential theft, unrelated data exfiltration, or package-controlled code execution.
Mechanism
The SDK posts a generated JSON report to its supplied collector endpoint and defaults widget scripts to Zerohash CDN hosts.
AI rationale
Source inspection found a browser Fund widget SDK with Zerohash-aligned CDN and telemetry endpoints. Its report POST is part of widget setup and no concrete malicious behavior was identified.
Network endpoints2
grafana-faro-collector.zerohash.com/collectsdk-cdn.zerohash.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies the package as the Zerohash Fund SDK and exposes its compiled distribution as the package entrypoint; it defines no lifecycle scripts.
- The declaration file describes a JavaScript SDK for integrating the Fund widget.
- In the browser, the SDK posts a generated report payload to a supplied endpoint; the default report path is used during widget setup.
- The configured default CDN and telemetry hosts belong to Zerohash domains.
Evidence against
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
6 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg1/**
* Zerohash Fund JavaScript SDK
*
* A programmatic JavaScript SDK for integrating the Fund widget
* into web applications without requiring HTML custom elements.
Low
Ai Review Evidence
The declaration file describes a JavaScript SDK for integrating the Fund widget.
dist/index.d.tsView on unpkg · L1package.jsonView file
1{
"name": "@zerohash-sdk/fund-js",
"version": "1.16.4",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.umd.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "fund-js"
}
}
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fund-js@1.16.4.
See all versions of @zerohash-sdk/fund-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-js@1.16.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.