@zerohash-sdk/fund-react@1.13.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a React wrapper for a remotely hosted Zerohash funding widget. Its remote loading and error reporting are runtime, user-invoked product behavior, with no malicious install-time or local-system behavior found.
Decision evidence
public snapshot- The exported React component dynamically inserts a module script selected from Zerohash CDN URLs when the component is rendered.
- The manifest exposes only the compiled React entrypoint and defines no lifecycle scripts or runtime self-dependency.
- No install-time hook, shell execution, filesystem access, credential harvesting, or persistence code was found.
- The network requests are limited to vendor-hosted widget loading and error telemetry triggered by widget load failures.
Source & flagged code
3 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest exposes only the compiled React entrypoint and defines no lifecycle scripts or runtime self-dependency.
package.jsonView on unpkg · L5Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.13.0.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.