@zerohash-sdk/profile-js@0.14.6
A programmatic JavaScript SDK for integrating the Connect Profile widget into web applications without requiring HTML custom elements or a specific framework.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and the runtime reporting path activates only after an explicitly requested widget load fails or times out. Its diagnostic payload goes to fixed Zerohash collectors, consistent with package-aligned telemetry.
Decision evidence
public snapshot- The manifest exposes JavaScript bundles and declarations and defines no lifecycle scripts.
- Rendering the widget triggers script loading; the declaration source passes its JWT and collector configuration to the loader.
- A script network error or timeout triggers diagnostic reporting.
- The report contains JWT-derived claims and page-origin metadata, and is sent as JSON to fixed Zerohash collector endpoints.
- The CommonJS bundle uses the same JSON POST reporting behavior.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgRendering the widget triggers script loading; the declaration source passes its JWT and collector configuration to the loader.
dist/index.d.tsView on unpkg · L101Rendering the widget triggers script loading; the declaration source passes its JWT and collector configuration to the loader.
dist/index.d.tsFindings
Affected versions and remediation
This report applies to @zerohash-sdk/profile-js@0.14.6.
See all versions of @zerohash-sdk/profile-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-js@0.14.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.