registry / @zerohash-sdk/fund-react / 1.13.2
@zerohash-sdk/fund-react@1.13.2
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source is a browser-only React wrapper for a hosted funding widget. Its network behavior is user-invoked and package-aligned, with no concrete malicious behavior found.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Fund React component in a browser.
Impact
The rendered application trusts the configured Zero Hash CDN widget; no package-side persistence, local data collection, or install-time mutation was found.
Mechanism
Dynamic vendor module loading with failure telemetry.
AI rationale
The source is a browser-only React wrapper for a hosted funding widget. Its network behavior is user-invoked and package-aligned, with no concrete malicious behavior found.
Evidence
dist/index.js
Network endpoints6
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eugrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no lifecycle scripts; its manifest exposes only the distribution bundle.
- When the Fund component is rendered, it loads a module script from fixed Zero Hash CDN URLs and sends load-failure telemetry to fixed collector URLs.
Evidence against
- No install-time execution, shell commands, filesystem access, environment harvesting, or credential exfiltration is present in the inspected bundle.
- The remote script loading and telemetry occur only through the React component's runtime effect, consistent with a hosted funding-widget SDK.
Behavioral surface
Network
UrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg4"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
Low
Suspicious Lifecycle Evidence
The package has no lifecycle scripts; its manifest exposes only the distribution bundle.
package.jsonView on unpkg · L4dist/index.jsView file
124}, N = (f, _) => {
v(), k = performance.now();
const l = document.createElement("script");
l.id = u, l.src = f, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
d || (customElements.get(t) ? (d = !0, v(), h?.()) : C("not-defined", f, _));
}, 0);
}, l.onerror = () => C("network", f, _), x = setTimeout(() => C("timeout", f, _), g), document.getElementById(u)?.remove(), document.head.appendChild(l);
}, T = z(n, a, s);
Findings
1 High1 Medium3 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.13.2.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.