registry / @zerohash-sdk/travel-rule-js / 0.6.0
@zerohash-sdk/travel-rule-js@0.6.0
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 25d ago · by lpm-firewall-aiInspected the manifest, declarations, and executable entrypoint. The observed network calls are tied to widget script loading and failure telemetry sent to Zerohash endpoints; no attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the SDK and invokes its render method; a failed widget script load can trigger diagnostic reporting.
Impact
The observed network activity supports the SDK's widget loading and diagnostics functions; no malicious behavior was established.
Mechanism
The SDK selects environment-specific script and collector URLs, loads the widget script, and posts a diagnostic payload containing app, session, browser, page, and load-failure context.
AI rationale
Inspected the manifest, declarations, and executable entrypoint. The observed network calls are tied to widget script loading and failure telemetry sent to Zerohash endpoints; no attack behavior was identified.
Evidence
dist/index.js
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points consumers to the SDK entrypoint and type declarations and declares no install lifecycle script.
- The declarations describe a travel-rule widget configured with a JWT and deposit identifier.
- The SDK posts diagnostic failure reports to Zerohash Faro collector endpoints.
- The widget loads a script from selected script URLs when rendering is invoked.
Evidence against
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
6 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg497export declare interface TravelRuleConfig extends BaseConfig<TravelRuleEvent>, TravelRuleCallbacks {
/**
* Deposit id the travel-rule submission is tied to. Required — every
* travel-rule submission is scoped to a specific deposit (TRD §4.1
Low
Ai Review Evidence
The declarations describe a travel-rule widget configured with a JWT and deposit identifier.
dist/index.d.tsView on unpkg · L497package.jsonView file
5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports":
Findings
1 High1 Medium6 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-js@0.6.0.
See all versions of @zerohash-sdk/travel-rule-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-js@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.