registry / Telemetry / @zerohash-sdk/onboarding-react / 1.15.14

@zerohash-sdk/onboarding-react@1.15.14

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package sends runtime telemetry automatically on onboarding script failure, including browser/page metadata and selected decoded JWT claims, without documenting it or exposing a disable option. This warrants a warning; the source does not show the full JWT being sent or unrelated malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Rendering the Onboarding component and encountering a script load, timeout, or registration failure.

Impact

The vendor receives this contextual failure data automatically. The source does not send the full JWT.

Mechanism

The package posts a report to a configured Zerohash Faro collector, including browser and page metadata, app details, script URL, and selected claims decoded from the supplied JWT.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints5

grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.
The report is sent by POST to a Faro collector; the React component supplies default collector URLs and triggers the loader when rendered.
The README describes the onboarding integration but does not mention this failure-reporting telemetry or a way to disable it.

Evidence against

package.json declares no lifecycle scripts.
The report is limited to a script-loading failure path; the source does not send the full JWT.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 10.3 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

5 flagged

dist/index.jsView file

44name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region), r && (i.zh_web_sdk_version = r), { sessionId: n, payload: { meta: { app: { name: e.appName, version: t ?? "unknown", environment: e.env }, session: { id: n, attributes: i }, browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0, page: typeof window < "u" ? { url: window.location.origin } : void 0 }, logs: [{ message: `Failed to lo

Medium

Ai Review Evidence

When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.

dist/index.jsView on unpkg · L44

93s, c), e, r)), b = !1, x = 0, S, C = () => { S !== void 0 && clearTimeout(S); }, w = (e, r, i) => { if (b) return; let o = Math.round(performance.now() - x), l = { webComponentTag: t, appName: n, env: s, scriptUrl: r, reason: e, triedFallback: i, elapsedMs: o, claims: v }; y(l); let u = i ? void 0 : d(a ?? {}, s, c); if (u && u !== r) { T(u, !0); return; } b = !0, C(), document.

Medium

Ai Review Evidence

When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.

dist/index.jsView on unpkg · L93

Findings

6 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

MediumAi Review EvidenceREADME.md

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/onboarding-react@1.15.14.

See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:26:56.884Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @zerohash-sdk/onboarding-react / 1.15.14

@zerohash-sdk/onboarding-react@1.15.14

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Rendering the Onboarding component and encountering a script load, timeout, or registration failure.

Impact

The vendor receives this contextual failure data automatically. The source does not send the full JWT.

Mechanism

The package posts a report to a configured Zerohash Faro collector, including browser and page metadata, app details, script URL, and selected claims decoded from the supplied JWT.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints5

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.
The report is sent by POST to a Faro collector; the React component supplies default collector URLs and triggers the loader when rendered.
The README describes the onboarding integration but does not mention this failure-reporting telemetry or a way to disable it.

Evidence against

package.json declares no lifecycle scripts.
The report is limited to a script-loading failure path; the source does not send the full JWT.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

dist/index.jsView file

Medium

Ai Review Evidence

When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.

dist/index.jsView on unpkg · L44

Medium

Ai Review Evidence

When onboarding script loading fails, the package builds a report containing app and environment details, selected decoded JWT claims, the script URL, browser user agent, and page origin.

dist/index.jsView on unpkg · L93

Findings

6 Medium1 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

MediumAi Review EvidenceREADME.md

LowUrl Strings

Affected versions and remediation

This report applies to @zerohash-sdk/onboarding-react@1.15.14.

See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 15:26:56.884Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.