@zerohash-sdk/onboarding-react@1.13.0
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a browser React wrapper that intentionally loads a Zerohash onboarding web component at render time and reports loading failures. No lifecycle hooks, local data harvesting, command execution, or persistence behavior appears in the inspected package.
Decision evidence
public snapshot- The React component dynamically loads a module from an environment-selected Zerohash CDN when Onboarding is rendered.
- On script-load failure it posts diagnostic metadata to a Zerohash Faro collector.
- The manifest has no lifecycle scripts and exposes only the built React entrypoint.
- No install-time execution, shell invocation, filesystem access, or persistence code was found.
- The remote loader and telemetry are invoked only during component use and match an onboarding-widget wrapper.
- The telemetry payload contains failure diagnostics, browser user agent, and page origin; it does not read cookies, storage, or environment variables.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest has no lifecycle scripts and exposes only the built React entrypoint.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-react@1.13.0.
See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-react@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.