registry / @zerohash-sdk/fund-react / 1.15.10
@zerohash-sdk/fund-react@1.15.10
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has no install lifecycle hooks and exports a React fund widget. Its runtime loads the widget from Zerohash CDN hosts and sends limited diagnostics to Zerohash collectors after load failures; the inspected source shows no unrelated recipient or other confirmed attack behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Fund component; diagnostic reporting occurs if the widget fails to load.
Impact
The widget receives the caller-provided JWT for its intended service. Failure diagnostics disclose limited runtime metadata to the package-aligned collector; no unrelated recipient or harmful action was identified.
Mechanism
The component loads an environment-selected widget script and posts failure context and limited browser, page, and JWT claim metadata to an environment-selected collector.
AI rationale
The package has no install lifecycle hooks and exports a React fund widget. Its runtime loads the widget from Zerohash CDN hosts and sends limited diagnostics to Zerohash collectors after load failures; the inspected source shows no unrelated recipient or other confirmed attack behavior.
Evidence
package.jsondist/index.js
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js and declares no lifecycle scripts.
- dist/index.js selects Zerohash CDN hosts for the environment-specific fund widget.
- The Fund component passes the caller-provided JWT to the Zerohash fund widget and uses it to select the widget environment.
- When widget loading fails, the bundle sends diagnostic metadata, including browser and page details and selected JWT claims, to an environment-specific Zerohash collector.
- The network behavior is consistent with loading and diagnosing the package’s fund widget; no unrelated recipient or other attack behavior was identified.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/fund-react",
"version": "1.15.10",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "fund-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js and declares no lifecycle scripts.
package.jsonView on unpkg · L1dist/index.jsView file
148"https://sdk-cdn.dev.0hash.com",
cert: "https://sdk-cdn.cert.zerohash.com",
prod: "https://sdk-cdn.zerohash.com",
"eu-cert": "https://sdk-cdn.cert.zerohash.eu",
"eu-prod": "https://sdk-cdn.zerohash.eu"
}, y = "https://sdk-cdn.gating.0hash.com", b = (e, t, n = {}) => {
let { eu: r = !1, legacyAliases: i = !1, local: a = v.l
Low
Ai Review Evidence
dist/index.js selects Zerohash CDN hosts for the environment-specific fund widget.
dist/index.jsView on unpkg · L148Findings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.15.10.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.15.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.