@zerohash-sdk/onboarding-js@1.15.9
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection found no install-time behavior or concrete attack. The network activity is tied to rendering the ZeroHash onboarding widget and reporting script-load failures to the package's environment-specific diagnostic collectors.
Decision evidence
public snapshot- package.json points runtime imports to dist/index.js and contains no lifecycle scripts.
- dist/index.d.ts describes a JWT-authenticated onboarding widget with caller-controlled rendering and configuration.
- The runtime loads the zerohash-onboarding widget from environment-specific ZeroHash CDN domains when render is called.
- On widget script-load failure, the SDK posts structured diagnostic data to environment-specific ZeroHash Grafana Faro collectors.
- Diagnostic data includes app, browser, page-origin, error details, and selected decoded JWT claims; the report body is the structured payload, not the JWT string.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgdist/index.d.ts describes a JWT-authenticated onboarding widget with caller-controlled rendering and configuration.
dist/index.d.tsView on unpkg · L25dist/index.d.ts describes a JWT-authenticated onboarding widget with caller-controlled rendering and configuration.
dist/index.d.tsView on unpkg · L405Findings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-js@1.15.9.
See all versions of @zerohash-sdk/onboarding-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-js@1.15.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.