@zerohash-sdk/profile-js@0.12.2
A programmatic JavaScript SDK for integrating the Connect Profile widget into web applications without requiring HTML custom elements or a specific framework.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a browser SDK whose network and script-loading behavior occurs only through its rendering API and aligns with widget integration. No lifecycle hooks, filesystem access, shell execution, credential harvesting, persistence, or covert exfiltration were found.
Decision evidence
public snapshot- The manifest exposes library entry points and contains no lifecycle-script section.
- At user render time, the SDK appends a configured profile widget module script and posts failure telemetry.
- The declaration file describes a browser Profile widget SDK, consistent with the runtime API.
- Rendering can load a remote vendor-hosted module into the host page.
- Failure telemetry includes browser user agent, page origin, and selected JWT-derived metadata, but not the JWT itself.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declaration file describes a browser Profile widget SDK, consistent with the runtime API.
dist/index.d.tsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @zerohash-sdk/profile-js@0.12.2.
See all versions of @zerohash-sdk/profile-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-js@0.12.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.