@zerohash-sdk/onboarding-react@1.15.13
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically reports component-load failures to a ZeroHash collector with browser, page, and selected JWT-claim data. This is service-related runtime telemetry, but it is not disclosed in the public component interface and has no apparent opt-out, so classify it as suspicious telemetry rather than malicious exfiltration.
Static reason
No blocking static signals were detected.
Trigger
The React component mounts and its web-component script fails to load, times out, or does not define the expected custom element.
Impact
ZeroHash receives browser and page metadata and selected participant or platform claims when loading fails; the package exposes no public telemetry opt-out.
Mechanism
The wrapper automatically POSTs JSON containing app and environment metadata, browser user agent, page origin, selected JWT claims, and script-load diagnostics to the environment’s configured collector.
AI rationale
The package automatically reports component-load failures to a ZeroHash collector with browser, page, and selected JWT-claim data. This is service-related runtime telemetry, but it is not disclosed in the public component interface and has no apparent opt-out, so classify it as suspicious telemetry rather than malicious exfiltration.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints11
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.gating.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports a React onboarding component that loads the ZeroHash onboarding web component.
- When script loading fails, the wrapper automatically creates a diagnostic report and sends it to the default ZeroHash Grafana collector.
- The report includes browser user agent, page origin, app and environment details, selected JWT claims, and script-load diagnostics.
- The public component types show no telemetry opt-out setting.
Evidence against
- The report is triggered by a component script-load failure, not by package installation or import alone.
- The collector and script hosts belong to the ZeroHash service used by this package; no unrelated recipient or raw JWT transmission was identified.
- The manifest declares no lifecycle scripts.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
320nt: d
});
let { loadFailed: m, retry: h } = T({
webComponentTag: D,
scriptUrls: E,
env: r,
jwt: t
});
return m ? /* @__PURE__ */ e(C, {
onRetry: h,
onClose: l
}) : n.createElement(D, {
ref: p,
jwt: t,
env: r,
theme: i,
onboardingFlow: o,
...f
});
};
//#endregion
export { O as Onb
Medium
Ai Review Evidence
The package exports a React onboarding component that loads the ZeroHash onboarding web component.
dist/index.jsView on unpkg · L3207https://grafana-faro-collector.zerohash.com/collect",
"eu-cert": "https://grafana-faro-collector.cert.zerohash.eu/collect",
"eu-prod": "https://graf
Medium
Ai Review Evidence
When script loading fails, the wrapper automatically creates a diagnostic report and sends it to the default ZeroHash Grafana collector.
dist/index.jsView on unpkg · L749ame: e.appName,
version: t ?? "unknown",
environment: e.env
},
session: {
id: n,
attributes: i
},
browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0,
page: typeof window < "u" ? { url: window.location.origin } : void 0
},
logs: [{
message: `Failed to load the script for ${e.webComponentTag} from ${e.env} environ
Findings
7 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.d.ts
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-react@1.15.13.
See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.