@zerohash-sdk/onboarding-react@1.13.2
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo source evidence shows malicious installation, persistence, theft, or hidden payload behavior. However, the package loads executable remote code without integrity protection, which is a concrete unresolved supply-chain risk and prevents a clean verdict under the required retry constraints.
Decision evidence
public snapshot- The package’s browser entry dynamically loads an environment-selected remote module when the React component mounts.
- The loader appends the remote module to the document head without an integrity pin, so CDN content executes in the host page.
- The manifest has no lifecycle scripts or runtime dependencies; inspection found no Node process, filesystem, or credential-harvesting behavior.
- Remote loading is initiated only by rendering the exported Onboarding component.
- The remote URLs are fixed Zerohash SDK/CDN and telemetry collector hosts, consistent with an onboarding widget.
- The telemetry POST is limited to script-load failure context, browser user agent, and page origin.
Source & flagged code
2 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkgThe manifest has no lifecycle scripts or runtime dependencies; inspection found no Node process, filesystem, or credential-harvesting behavior.
package.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-react@1.13.2.
See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-react@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.