registry / @zerohash-sdk/onboarding-react / 1.15.5

@zerohash-sdk/onboarding-react@1.15.5

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The manifest identifies a React onboarding library with no install lifecycle hook, and the inspected bundle uses Zerohash CDN and collector endpoints for component loading and failure telemetry. No concrete malicious behavior was established.

Static reason

No blocking static signals were detected.

Trigger

The consumer renders the Onboarding component, or its remote component load fails.

Impact

This supports the package's onboarding and failure-reporting functions; inspected source does not establish credential theft or another attack.

Mechanism

The bundle appends a module script for the selected CDN URL and posts load-failure diagnostics, including page origin and app metadata, to a collector URL.

AI rationale

Network endpoints10

sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eugrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points to dist/index.js and declares no lifecycle scripts.
dist/index.js sends failure diagnostics to configured collector URLs, including app and page metadata.
The component loads a web component from Zerohash CDN hosts when rendered.
The bundle shows no credential harvesting, shell execution, or obfuscated execution in the inspected paths.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 10.2 KB of source, external domains: ff-edge.dev.0hash.com, grafana-faro-collector.cert.zerohash.com, grafana-faro-collector.cert.zerohash.eu, grafana-faro-collector.dev.0hash.com, grafana-faro-collector.zerohash.com, grafana-faro-collector.zerohash.eu, sdk-cdn.cert.zerohash.com, sdk-cdn.cert.zerohash.eu, sdk-cdn.dev.0hash.com, sdk-cdn.gating.0hash.com, sdk-cdn.zerohash.com, sdk-cdn.zerohash.eu

Source & flagged code

4 flagged

package.jsonView file

2"name": "@zerohash-sdk/onboarding-react", "version": "1.15.5", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "licens

Low

Suspicious Lifecycle Evidence

package.json points to dist/index.js and declares no lifecycle scripts.

package.jsonView on unpkg · L2

dist/index.jsView file

66scriptUrl, reason: e.reason, tried_fallback: String(e.triedFallback), elapsed_ms: String(e.elapsedMs) } }] } }; }, g = (e, t, n) => { if (!e || typeof fetch > "u") return; let { sessionId: r, payload: i } = h(t, n); try { fetch(e, { method: "POST", headers: { "Content-Type": "application/json", "x-faro-session-id": r }, body: JSON.stringify(i), keepalive: !0 }).catch(() => void 0); } catch {} }, _ = (e) => { let { webComponentTag: t, appName: n, appVersion: r

Low

Ai Review Evidence

dist/index.js sends failure diagnostics to configured collector URLs, including app and page metadata.

dist/index.jsView on unpkg · L66

Findings

1 Medium5 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/onboarding-react@1.15.5.

See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 05:17:39.101Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @zerohash-sdk/onboarding-react / 1.15.5

@zerohash-sdk/onboarding-react@1.15.5

A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

The consumer renders the Onboarding component, or its remote component load fails.

Impact

This supports the package's onboarding and failure-reporting functions; inspected source does not establish credential theft or another attack.

Mechanism

The bundle appends a module script for the selected CDN URL and posts load-failure diagnostics, including page origin and app metadata, to a collector URL.

AI rationale

Network endpoints10

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points to dist/index.js and declares no lifecycle scripts.
dist/index.js sends failure diagnostics to configured collector URLs, including app and page metadata.
The component loads a web component from Zerohash CDN hosts when rendered.
The bundle shows no credential harvesting, shell execution, or obfuscated execution in the inspected paths.

Evidence against

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

package.jsonView file

2"name": "@zerohash-sdk/onboarding-react", "version": "1.15.5", "private": false, "type": "module", "main": "./dist/index.js", "module": "./dist/index.js", "types": "./dist/index.d.ts", "licens

Low

Suspicious Lifecycle Evidence

package.json points to dist/index.js and declares no lifecycle scripts.

package.jsonView on unpkg · L2

dist/index.jsView file

Low

Ai Review Evidence

dist/index.js sends failure diagnostics to configured collector URLs, including app and page metadata.

dist/index.jsView on unpkg · L66

Findings

1 Medium5 Low

MediumNetwork

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @zerohash-sdk/onboarding-react@1.15.5.

See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.

Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 05:17:39.101Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.