@zerohash-sdk/profile-js@0.14.10
A programmatic JavaScript SDK for integrating the Connect Profile widget into web applications without requiring HTML custom elements or a specific framework.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK performs disclosed, purpose-related failure reporting to Zerohash collectors, but the report includes page and browser context plus JWT claims and has no documented opt-out. This warrants a warning for runtime telemetry; the behavior is triggered by an explicit render and is limited to load failures.
Decision evidence
public snapshot- The SDK sends a POST to Zerohash Faro collector endpoints when the web component load fails.
- The report includes browser user agent, the page's origin, and decoded JWT claims such as participant and platform identifiers.
- The public type declaration documents Faro failure reporting with JWT claims, but exposes no telemetry opt-out.
- The package has no lifecycle scripts; its entry points export a widget SDK.
- Script loading and failure reporting occur when the caller renders the widget, not automatically at import.
- The report is limited to script-load failures and is sent to Zerohash collector hosts.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe public type declaration documents Faro failure reporting with JWT claims, but exposes no telemetry opt-out.
dist/index.d.tsView on unpkg · L220Findings
Affected versions and remediation
This report applies to @zerohash-sdk/profile-js@0.14.10.
See all versions of @zerohash-sdk/profile-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-js@0.14.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.