registry / @zerohash-sdk/fund-react / 1.15.0
@zerohash-sdk/fund-react@1.15.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiInspected package.json and the complete dist/index.js source. Its browser network behavior is consistent with loading the Zerohash-hosted component and reporting its load failures; no malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Fund component in a browser; failure telemetry is sent if loading fails.
Impact
The evidenced behavior supports the package's hosted fund component integration; no confirmed attack surface was established.
Mechanism
The component creates a module script element for the selected web component URL and posts failure details to a fixed collector endpoint.
AI rationale
Inspected package.json and the complete dist/index.js source. Its browser network behavior is consistent with loading the Zerohash-hosted component and reporting its load failures; no malicious behavior was identified.
Network endpoints3
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the React component entrypoint and has no lifecycle scripts.
- The component sends load-failure telemetry to fixed Zerohash collector endpoints.
- When used in a browser, it loads a module script for its web component and reports load failures.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
2"name": "@zerohash-sdk/fund-react",
"version": "1.15.0",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
Low
Suspicious Lifecycle Evidence
package.json declares the React component entrypoint and has no lifecycle scripts.
package.jsonView on unpkg · L2dist/index.jsView file
3const $ = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-fa
Low
Ai Review Evidence
The component sends load-failure telemetry to fixed Zerohash collector endpoints.
dist/index.jsView on unpkg · L384fetch(e, {
method: "POST",
headers: { "Content-Type": "application/json", "x-faro-session-id": r },
body: JSON.stringify(n),
keepalive: !0
}).catch(() => {
});
} catc
Findings
1 Medium5 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.15.0.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.