@zerohash-sdk/onboarding-react@1.15.7
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Onboarding product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the inspected runtime behavior is consistent with an onboarding React wrapper. Its network activity loads the branded widget and sends limited diagnostics when loading fails; no concrete attack behavior was found.
Decision evidence
public snapshot- package.json points to dist/index.js and defines no lifecycle scripts.
- The React wrapper loads the Zerohash onboarding component using the supplied JWT and environment; production is the default.
- The loader inserts an asynchronous module script from environment-specific Zerohash CDN URLs.
- Network errors and timeouts during widget loading invoke the diagnostic reporter.
- The reporter posts diagnostic data, including browser user agent and page origin, to environment-mapped Zerohash collector URLs.
Source & flagged code
8 flaggedpackage.json points to dist/index.js and defines no lifecycle scripts.
package.jsonView on unpkg · L1The React wrapper loads the Zerohash onboarding component using the supplied JWT and environment; production is the default.
dist/index.jsView on unpkg · L322Findings
Affected versions and remediation
This report applies to @zerohash-sdk/onboarding-react@1.15.7.
See all versions of @zerohash-sdk/onboarding-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/onboarding-react@1.15.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.