registry / @zerohash-sdk/onboarding-js / 1.13.4
@zerohash-sdk/onboarding-js@1.13.4
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiSource inspection found no install lifecycle hooks. The runtime loads the vendor onboarding widget from environment-specific ZeroHash CDN hosts and posts only widget-load failure telemetry to the corresponding collector; no concrete malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer creates the SDK and invokes its widget loading flow; telemetry is sent when widget loading fails.
Impact
The inspected behavior supports the onboarding widget and failure reporting; no credential theft, unrelated destination, or other concrete attack surface was established.
Mechanism
The runtime posts a limited failure report with app and environment data, browser user agent, page origin, and script-load context. It requires a caller-provided JWT and selects collector and script URLs by environment.
AI rationale
Source inspection found no install lifecycle hooks. The runtime loads the vendor onboarding widget from environment-specific ZeroHash CDN hosts and posts only widget-load failure telemetry to the corresponding collector; no concrete malicious behavior was identified.
Evidence
package.jsondist/index.jsdist/index.d.ts
Network endpoints11
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the browser SDK entry point and declares no lifecycle scripts.
- The declarations describe a programmatic JavaScript SDK for integrating the Onboarding widget.
- The runtime sends load-failure telemetry containing app, browser, page-origin, and error context to its configured collector.
- The collector request is triggered by widget loading and sends a POST; the SDK runtime supplies environment-specific ZeroHash collector URLs.
- The widget script is loaded during the SDK's loadScript path, and construction requires a caller-provided JWT.
- Script URLs use environment-specific ZeroHash CDN hosts, consistent with the package's stated SDK purpose.
Evidence against
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
8 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg1/**
* Zerohash Onboarding JavaScript SDK
*
* A programmatic JavaScript SDK for integrating the Onboarding widget
* into we
Low
Ai Review Evidence
The declarations describe a programmatic JavaScript SDK for integrating the Onboarding widget.
dist/index.d.tsView on unpkg · L1package.jsonView file
1{
"name": "@zerohash-sdk/onboarding-js",
"version": "1.13.4",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./
Low
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-js@1.13.4.
See all versions of @zerohash-sdk/onboarding-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-js@1.13.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.