registry / @zerohash-sdk/profile-react / 0.14.8
@zerohash-sdk/profile-react@0.14.8
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Profile product.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest exports a React component without install hooks. The inspected runtime loads its ZeroHash profile web component and sends environment-specific diagnostics to ZeroHash collectors after load failures; no malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
The consumer renders the exported Profile component; diagnostic reporting is triggered by a script-load failure.
Impact
The inspected behavior supports the SDK’s profile-loading and failure-reporting functions; no credential export or other attack behavior was identified.
Mechanism
The component loads a profile web component from a configured ZeroHash CDN and reports failure details, including app and page metadata, to a configured ZeroHash Faro collector.
AI rationale
The manifest exports a React component without install hooks. The inspected runtime loads its ZeroHash profile web component and sends environment-specific diagnostics to ZeroHash collectors after load failures; no malicious behavior was found.
Evidence
package.jsondist/index.js
Network endpoints8
sdk-cdn.zerohash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.eusdk-cdn.dev.0hash.comgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.eu/collectgrafana-faro-collector.dev.0hash.com/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the dist bundle and declares no lifecycle scripts.
- The profile component is loaded from environment-specific ZeroHash CDN URLs when the React component is mounted.
- The bundle sends failure reports to configured ZeroHash Faro collectors; the report contains app, browser, page-origin, and script-load diagnostic metadata.
- The exported Profile component passes its caller-provided JWT to the profile web component.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
1{
"name": "@zerohash-sdk/profile-react",
"version": "0.14.8",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "
Low
Suspicious Lifecycle Evidence
package.json exports the dist bundle and declares no lifecycle scripts.
package.jsonView on unpkg · L1dist/index.jsView file
147N_HOST || "http://localhost:5173",
dev: "https://sdk-cdn.dev.0hash.com",
cert: "https://sdk-cdn.cert.zerohash.com",
prod: "https://sdk-cdn.zerohash.com",
"eu-cert": "https://sdk-cdn.cert.zerohash.eu",
"eu-prod": "https://sdk-cdn.zerohash.eu"
}, y = "https://sdk-cdn.gating.0hash.com", b = (e, t, n = {}) => {
let { eu: r = !1, legacyAliases: i = !1, local: a = v.local } = n, o = (n) => `${n}/${e}/${t}`, s = {
local: o(a),
dev: o(v.dev),
gating: o(y),
cert: o(v.cert),
prod: o(v.prod
Low
Ai Review Evidence
The profile component is loaded from environment-specific ZeroHash CDN URLs when the React component is mounted.
dist/index.jsView on unpkg · L147Findings
1 Medium6 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/profile-react@0.14.8.
See all versions of @zerohash-sdk/profile-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/profile-react@0.14.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.