registry / @zerohash-sdk/profile-react / 0.12.2
@zerohash-sdk/profile-react@0.12.2
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Profile product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a React wrapper that deliberately injects a Zerohash-hosted web component when rendered and sends load-failure telemetry to Zerohash. Source inspection found no automatic lifecycle execution, local-data harvesting, destructive actions, or covert persistence.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Profile React component.
Impact
The consumer browser executes the configured vendor CDN module; failure reports include operational metadata.
Mechanism
User-invoked vendor web-component loading with failure telemetry.
AI rationale
This is a React wrapper that deliberately injects a Zerohash-hosted web component when rendered and sends load-failure telemetry to Zerohash. Source inspection found no automatic lifecycle execution, local-data harvesting, destructive actions, or covert persistence.
Evidence
package.jsondist/index.jsdist/index.d.tsREADME.md
Network endpoints11
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eusdk-cdn.gating.0hash.comgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts and exposes only the bundled dist entry point.
- Rendering the Profile component loads its named web component from Zerohash CDN URLs.
- A failed component load posts limited diagnostic telemetry to a Zerohash collector.
Evidence against
- No install-time execution, shell use, file access, persistence, or self-dependency is present.
- The remote script and telemetry are activated by rendering the documented React component and use package-aligned Zerohash endpoints.
- The telemetry payload is an error report containing load context, browser user agent, origin, and selected decoded JWT claims; no credential harvesting or unrelated exfiltration is shown.
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg4"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
Low
Suspicious Lifecycle Evidence
The manifest has no lifecycle scripts and exposes only the bundled dist entry point.
package.jsonView on unpkg · L4dist/index.jsView file
124}, N = (p, h) => {
R(), w = performance.now();
const l = document.createElement("script");
l.id = g, l.src = p, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
f || (customElements.get(t) ? (f = !0, R(), b?.()) : x("not-defined", p, h));
}, 0);
}, l.onerror = () => x("network", p, h), v = setTimeout(() => x("timeout", p, h), m), document.getElementById(g)?.remove(), document.head.appendChild(l);
}, T = z(n, a, s);
return T ? (N(T, !1), () => {
f = !0, R();
}) : O;
Findings
1 High1 Medium4 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/profile-react@0.12.2.
See all versions of @zerohash-sdk/profile-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-react@0.12.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.