@zerohash-sdk/fund-react@1.15.13
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package performs undisclosed runtime telemetry on widget load failures, including the embedding page’s origin and JWT-derived participant/platform claims. This is a warning-level telemetry concern; the widget loader and its CDN access otherwise fit the package’s stated purpose.
Decision evidence
public snapshot- On widget load failures, the report payload includes the app name, environment, script URL, error reason, and JWT-derived claims such as participant and platform identifiers.
- The report also includes the browser user agent and the embedding page’s origin.
- The package posts these reports to ZeroHash’s Faro collector without a documented disclosure or opt-out in the README.
- Reporting is triggered by widget script load errors or timeouts after the Fund component starts its loader.
- The package is a React wrapper for ZeroHash’s funding widget, and loading its widget script from ZeroHash’s CDN is consistent with that purpose.
- The manifest has no lifecycle scripts, and the loader starts from the Fund component’s React effect rather than at package installation.
- The report is limited to widget-loading failures; no credential or full JWT transmission was identified.
Source & flagged code
8 flaggedOn widget load failures, the report payload includes the app name, environment, script URL, error reason, and JWT-derived claims such as participant and platform identifiers.
dist/index.jsView on unpkg · L96On widget load failures, the report payload includes the app name, environment, script URL, error reason, and JWT-derived claims such as participant and platform identifiers.
dist/index.jsView on unpkg · L44Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.15.13.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.15.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.