@zerohash-sdk/profile-react@0.14.11
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Profile product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package reports runtime load failures to a vendor collector by default, including page and browser context and selected JWT claims. Because this reporting is not documented in the public API and has no documented opt-out, classify it as suspicious telemetry.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders Profile and the remote component load fails.
Impact
The vendor receives app and page context and selected identity-related claims without a documented opt-out; this is a telemetry concern, not evidence of credential theft.
Mechanism
The default error reporter sends a POST with diagnostic data, including selected JWT claims, browser user agent, page origin, and load error details, to the environment’s ZeroHash collector.
AI rationale
The package reports runtime load failures to a vendor collector by default, including page and browser context and selected JWT claims. Because this reporting is not documented in the public API and has no documented opt-out, classify it as suspicious telemetry.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Rendering the Profile component starts the web-component loading effect.
- If the remote component fails to load, the default reporter posts diagnostics to a ZeroHash collector.
- The report includes JWT-derived participant and platform claims, browser user agent, and the page origin.
- The public Profile props do not document a telemetry opt-out.
Evidence against
- There are no install lifecycle scripts.
- The network behavior is tied to loading the package’s profile widget, and the collector is a ZeroHash service.
- The package does not make a request merely by being imported.
Behavioral surface
Network
UrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
283}, T = (e) => {
let { webComponentTag: t, appName: n, appVersion: a, scriptUrls: c, fallbackScriptUrls: l, collectorUrls: u, env: d, jwt: f, timeoutMs: p } = e, [m, h] = o(!1), [g, v] = o(0);
return i(() => (h(!1), _({
webComponentTag: t,
appName: n ?? t,
appVersion: a,
scriptUrls: c,
fallbackScriptUrls: l,
collectorUrls: u ?? s,
env: d,
jwt: f,
timeoutMs: p,
onError: () => h(!0)
})),
Medium
Ai Review Evidence
Rendering the Profile component starts the web-component loading effect.
dist/index.jsView on unpkg · L28389let { webComponentTag: t, appName: n, appVersion: r, scriptUrls: i, fallbackScriptUrls: a, collectorUrls: o, env: s, jwt: c, timeoutMs: l = 15e3, onLoad: m, onError: h } = e;
if (typeof document > "u") return p;
let _ = `${t}-script-${s}`;
if (customElements.get(t) || document.getElementById(_)) return p;
let v = u(c), y = e.report ?? ((e) => g(o && f(o, s, c), e, r)), b =
Medium
Ai Review Evidence
If the remote component fails to load, the default reporter posts diagnostics to a ZeroHash collector.
dist/index.jsView on unpkg · L8943let n = m(), r = globalThis.__ZH_WEB_SDK_VERSION__, i = {};
return e.claims.participantCode && (i.participant_code = e.claims.participantCode), e.claims.platformName && (i.platform_name = e.claims.platformName), e.claims.platformCode && (i.platform_code = e.claims.platformCode), e.claims.region && (i.region = e.claims.region),
Findings
5 Medium1 Low
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @zerohash-sdk/profile-react@0.14.11.
See all versions of @zerohash-sdk/profile-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-react@0.14.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.