registry / @zerohash-sdk/fund-react / 1.14.0
@zerohash-sdk/fund-react@1.14.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts and points to the inspected distribution entrypoint. The network behavior is conditional error reporting to package-aligned Zerohash collector endpoints, and the inspected report construction does not send the JWT itself.
Static reason
No blocking static signals were detected.
Trigger
Importing and rendering the Fund component triggers the component script load; a load failure triggers the report.
Impact
This supports the package's component loading and diagnostics. The inspected code does not show credential exfiltration or other concrete attack behavior.
Mechanism
The report posts load-error context to a collector selected for the configured environment. The JWT is used to parse claims and select region-specific URLs.
AI rationale
The manifest has no lifecycle scripts and points to the inspected distribution entrypoint. The network behavior is conditional error reporting to package-aligned Zerohash collector endpoints, and the inspected report construction does not send the JWT itself.
Evidence
package.jsondist/index.js
Network endpoints3
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js as the package entrypoint.
- The package defines collector endpoints on Zerohash domains.
- The collector sends an error report as JSON after a script loading failure.
- The report contains app, session, browser, page, and load-error context; the component passes the JWT to region and claim parsing and script URL selection.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
6"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license
Low
Ai Review Evidence
package.json exports dist/index.js as the package entrypoint.
package.jsonView on unpkg · L6dist/index.jsView file
3const $ = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-co
Low
Ai Review Evidence
The package defines collector endpoints on Zerohash domains.
dist/index.jsView on unpkg · L384fetch(e, {
method: "POST",
headers: { "Content-Type": "application/json", "x-faro-session-id": r },
body: JSON.stringify(n),
keepalive: !0
}).catch(() => {
});
} catch {
}
}, Z = (e) => {
const { webComponentTag:
Low
Findings
1 Medium7 Low
MediumNetwork
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.14.0.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.