@zerohash-sdk/profile-react@0.14.10
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Profile product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package performs undisclosed runtime telemetry on widget load failures, including browser and page context and selected JWT claims. This warrants a warning, though the shown code does not send the full JWT and the reporting is limited to failure cases.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Profile component and its web-component script encounters a load error, timeout, or missing custom element.
Impact
The vendor receives browser and application context, including JWT claim values, without a documented telemetry disclosure or opt-out.
Mechanism
The handler POSTs a Faro event containing app and failure details, browser user agent, page origin, and selected claims decoded from the supplied JWT to a ZeroHash collector.
AI rationale
The package performs undisclosed runtime telemetry on widget load failures, including browser and page context and selected JWT claims. This warrants a warning, though the shown code does not send the full JWT and the reporting is limited to failure cases.
Evidence
dist/index.js
Network endpoints10
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- When the Profile component’s web-component script fails to load, the error handler reports the failure with app, environment, script URL, timing, and decoded JWT claims.
- The report payload includes browser user agent and page origin, and is POSTed as JSON to a configured ZeroHash Grafana Faro collector.
- The package does not disclose this runtime telemetry or provide a visible opt-out in its documented component props.
Evidence against
- The manifest has no lifecycle scripts; its entry point exports a React component.
- The external script is loaded from the ZeroHash SDK CDN as part of the package’s stated purpose.
- The report is limited to a script-load failure path and selected JWT claims; the full JWT is not included in the shown payload.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
97let o = Math.round(performance.now() - x), l = {
webComponentTag: t,
appName: n,
env: s,
scriptUrl: r,
reason: e,
triedFallback: i,
elapsedMs: o,
claims: v
};
y(l);
let u = i ? void 0 : d(a ?? {}, s, c);
if (u && u !== r) {
T(u, !0);
return;
}
b = !0, C(),
Medium
Ai Review Evidence
When the Profile component’s web-component script fails to load, the error handler reports the failure with app, environment, script URL, timing, and decoded JWT claims.
dist/index.jsView on unpkg · L9753session: {
id: n,
attributes: i
},
browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0,
page: typeof window < "u" ? { url: window.location.origin } : void 0
},
logs: [{
message: `Failed to load the script for ${e.webComponentTag} from ${e.env} environment.`,
level: "error",
timestamp: (/*
Medium
Ai Review Evidence
The report payload includes browser user agent and page origin, and is POSTed as JSON to a configured ZeroHash Grafana Faro collector.
dist/index.jsView on unpkg · L5374}, g = (e, t, n) => {
if (!e || typeof fetch > "u") return;
let { sessionId: r, payload: i } = h(t, n);
try {
fetch(e, {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-faro-session-id": r
},
body: JSON.stringify(i),
keepalive: !0
}).catch(() => void 0);
} catc
Findings
6 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/profile-react@0.14.10.
See all versions of @zerohash-sdk/profile-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-react@0.14.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.