@zerohash-sdk/onboarding-js@1.15.7
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. The runtime performs caller-triggered widget loading and conditionally sends failure diagnostics to Zerohash collectors; the inspected diagnostic body contains decoded claims and browser context, not the raw JWT.
Decision evidence
public snapshot- The manifest exports the SDK from dist/index.js and declares no lifecycle scripts.
- The SDK accepts a caller-provided JWT and renders the widget when the caller invokes render.
- Widget scripts use Zerohash CDN URLs; load failures can trigger diagnostic reporting to Zerohash Faro collectors.
- Failure diagnostics include decoded JWT claims, the browser user agent, and the page origin.
- Diagnostics are sent as a POST only when the loader reports a script failure; the inspected code does not send the raw JWT.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe SDK accepts a caller-provided JWT and renders the widget when the caller invokes render.
dist/index.d.tsView on unpkg · L22The SDK accepts a caller-provided JWT and renders the widget when the caller invokes render.
dist/index.d.tsFindings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-js@1.15.7.
See all versions of @zerohash-sdk/onboarding-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-js@1.15.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.