@zerohash-sdk/fund-react@1.15.12
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends runtime error telemetry without a surfaced disclosure or opt-out, and the payload includes page origin and selected JWT claims in addition to ordinary failure diagnostics. This is suspicious telemetry, not credential exfiltration: the token itself is not sent, and reporting is limited to script-load failures.
Static reason
No blocking static signals were detected.
Trigger
The Fund component’s web script fails to load or times out.
Impact
The vendor receives the application’s page origin, browser user-agent, app metadata, selected JWT claims, and load-failure details without a surfaced telemetry disclosure or opt-out.
Mechanism
The wrapper builds a diagnostic payload and POSTs it to a configured Grafana Faro collector.
AI rationale
The package sends runtime error telemetry without a surfaced disclosure or opt-out, and the payload includes page origin and selected JWT claims in addition to ordinary failure diagnostics. This is suspicious telemetry, not credential exfiltration: the token itself is not sent, and reporting is limited to script-load failures.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints10
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package defines Grafana Faro collector endpoints for its Zerohash environments.
- The diagnostic payload includes app details, selected decoded JWT claims, browser user-agent, page origin, and script-load failure context; it does not include the JWT itself.
- The package POSTs this payload to the selected collector when the web component script fails to load or times out.
- The package manifest points to dist/index.js and declares no lifecycle scripts.
Evidence against
- Reporting is limited to script-load errors; the wrapper otherwise loads the vendor’s Fund web component as part of its React SDK function.
- The collector is a Zerohash Faro endpoint, and the reported fields are error diagnostics rather than credentials or file contents.
- The manifest has no install hook, and the network request is in the component’s runtime error path, not import-time code.
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
1import { jsx as e, jsxs as t } from "react/jsx-runtime";
import n, { useCallback as r, useEffect as i, useRef as a, useState as o } from "react";
//#region ../../../common/js-sdk-base/dist/constants.js
var s = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://gra
Medium
Ai Review Evidence
The package defines Grafana Faro collector endpoints for its Zerohash environments.
dist/index.jsView on unpkg · L141from(e, (e) => e.toString(16).padStart(2, "0")).join("");
}, h = (e, t) => {
let n = m(), r = globalThis.__ZH_WEB_SDK_VERSION__, i = {};
return e.claims.participantCode && (i.participant_code = e.claims.participantCode), e.claims.platformName && (i.platform_name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region), r && (i.zh_web_sdk_version = r), {
sessionId: n,
payload: {
meta: {
app: {
name: e.appName,
Medium
Ai Review Evidence
The diagnostic payload includes app details, selected decoded JWT claims, browser user-agent, page origin, and script-load failure context; it does not include the JWT itself.
dist/index.jsView on unpkg · L4155
Findings
8 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumSuspicious Lifecycle Evidencepackage.json
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.15.12.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.15.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.