registry / @zerohash-sdk/fund-react / 1.15.6
@zerohash-sdk/fund-react@1.15.6
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Fund product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe published entrypoint implements a React wrapper for a Zerohash-hosted fund widget. Its diagnostic send is tied to widget load failure and targets Zerohash collector hosts, so the inspected network behavior is package-aligned.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Fund component; reporting occurs only after a widget loading failure.
Impact
This supports widget loading and error diagnostics; inspected source showed no unrelated credential disclosure or consumer-project mutation.
Mechanism
The wrapper selects widget and collector URLs by environment, then posts app, browser, page, and selected token-claim metadata to the mapped collector.
AI rationale
The published entrypoint implements a React wrapper for a Zerohash-hosted fund widget. Its diagnostic send is tied to widget load failure and targets Zerohash collector hosts, so the inspected network behavior is package-aligned.
Evidence
dist/index.js
Network endpoints5
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the bundled entrypoint and declares no lifecycle scripts or runtime dependencies.
- The Fund component loads the Zerohash-hosted widget for the selected environment and passes it the caller-supplied authentication token.
- A widget load failure triggers a diagnostic report containing app and environment details, browser and page information, and selected claims decoded from the token.
- The report is posted to an environment-mapped Zerohash collector; no unrelated recipient or hidden consumer-project mutation was identified.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/fund-react",
"version": "1.15.6",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "fund-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
The manifest exports the bundled entrypoint and declares no lifecycle scripts or runtime dependencies.
package.jsonView on unpkg · L1dist/index.jsView file
311web", "index.js", { eu: !0 }), D = "zerohash-fund", O = ({ jwt: t, env: r = "prod", theme: i, appRedirectUrl: o, branding: s, isPay: c = !1, onCompleted: l, onFailed: u, onDeposit: d, onProvideInfo: f, onError: p, onClose: m, onLoaded: h, onEvent: g, ..._ }) => {
let v = a(null);
w(v, {
isPay: c,
theme: i,
branding: s,
onCompleted: l,
onFailed: u,
onDeposit: d,
onProvideInfo: f,
onError: p,
onClose: m,
onLoaded: h,
onEvent: g
});
let { loadFailed: y, retry: b
Low
Ai Review Evidence
Findings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/fund-react@1.15.6.
See all versions of @zerohash-sdk/fund-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/fund-react@1.15.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.