@zerohash-sdk/onboarding-react
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.
This report shows the evidence for @zerohash-sdk/onboarding-react@1.15.14. 0 of 21 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package sends runtime telemetry automatically on onboarding script failure, including browser/page metadata and selected decoded JWT claims, without documenting it or exposing a disable option. This warrants a warning; the source does not show the full JWT being sent or unrelated malicious behavior.
Decision evidence
public snapshot- When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.
- The report is sent by POST to a Faro collector; the React component supplies default collector URLs and triggers the loader when rendered.
- The README describes the onboarding integration but does not mention this failure-reporting telemetry or a way to disable it.
- package.json declares no lifecycle scripts.
- The report is limited to a script-loading failure path; the source does not send the full JWT.
Source & flagged code
5 flaggedWhen onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.
dist/index.jsView on unpkg · L44When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.
dist/index.jsView on unpkg · L93Findings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-react@1.15.14.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.