registry / @zerohash-sdk/fund-react / 1.13.4

@zerohash-sdk/fund-react@1.13.4

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The published entrypoint is a React SDK wrapper with no install hooks. Its network behavior loads the corresponding ZeroHash web component and sends limited diagnostics to ZeroHash collector endpoints when loading fails; no concrete attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

A consumer renders the Fund component; diagnostic reporting occurs if loading fails.

Impact

This performs package-aligned SDK loading and diagnostics; inspected source shows no credential collection or unrelated data exfiltration.

Mechanism

The wrapper loads an environment-selected SDK script and may POST a diagnostic payload containing app, page, browser, and load-error details to a collector URL.

AI rationale

Evidence

package.jsondist/index.js

Network endpoints10

grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points package imports to dist/index.js and contains no lifecycle scripts or runtime dependencies.
dist/index.js sends load-failure diagnostics to configured collector URLs; the payload contains app, page, browser, and load-error details.
The React component loads a web component script through a script element when used; its configured defaults are ZeroHash SDK CDN hosts.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.54 KB of source, external domains: grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

5 flagged

package.jsonView file

1{ "name": "@zerohash-sdk/fund-react", "version": "1.13.4", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "license": "MIT", "exports": { "./package.json"

Low

Suspicious Lifecycle Evidence

package.json points package imports to dist/index.js and contains no lifecycle scripts or runtime dependencies.

package.jsonView on unpkg · L1

11"./package.json": "./package.json", ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js", "default": "./dist/index.js" } }, "files": [ "dist", "!**/*.tsbuildinfo" ], "nx": { "name": "fund-react" }, "peerDependencies": { "react": ">=18.0.0", "react-dom": ">=18.0.0" } }

Low

Suspicious Lifecycle Evidence

package.json points package imports to dist/index.js and contains no lifecycle scripts or runtime dependencies.

package.jsonView on unpkg · L11

dist/index.jsView file

Findings

1 Medium6 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/fund-react@1.13.4.

See all versions of @zerohash-sdk/fund-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/fund-react@1.13.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 05:19:12.863Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zerohash-sdk/fund-react / 1.13.4

@zerohash-sdk/fund-react@1.13.4

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A consumer renders the Fund component; diagnostic reporting occurs if loading fails.

Impact

This performs package-aligned SDK loading and diagnostics; inspected source shows no credential collection or unrelated data exfiltration.

Mechanism

The wrapper loads an environment-selected SDK script and may POST a diagnostic payload containing app, page, browser, and load-error details to a collector URL.

AI rationale

Evidence

package.jsondist/index.js

Network endpoints10

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points package imports to dist/index.js and contains no lifecycle scripts or runtime dependencies.
dist/index.js sends load-failure diagnostics to configured collector URLs; the payload contains app, page, browser, and load-error details.
The React component loads a web component script through a script element when used; its configured defaults are ZeroHash SDK CDN hosts.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

package.jsonView file

Low

Suspicious Lifecycle Evidence

package.json points package imports to dist/index.js and contains no lifecycle scripts or runtime dependencies.

package.jsonView on unpkg · L1

Low

Suspicious Lifecycle Evidence

package.json points package imports to dist/index.js and contains no lifecycle scripts or runtime dependencies.

package.jsonView on unpkg · L11

dist/index.jsView file

Findings

1 Medium6 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/fund-react@1.13.4.

See all versions of @zerohash-sdk/fund-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/fund-react@1.13.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 05:19:12.863Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.