registry / @zerohash-sdk/travel-rule-js / 0.7.7
@zerohash-sdk/travel-rule-js@0.7.7
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe inspected manifest has no install lifecycle hook, and the published runtime performs SDK-aligned widget loading and failure reporting to Zerohash endpoints. No concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render(), and telemetry is sent only after widget loading fails.
Impact
The collector receives app and session metadata, selected JWT claims, browser user agent, and page origin; no JWT transfer is shown.
Mechanism
The SDK loads a Zerohash-hosted widget and posts load-failure metadata to an environment-specific Zerohash collector.
AI rationale
The inspected manifest has no install lifecycle hook, and the published runtime performs SDK-aligned widget loading and failure reporting to Zerohash endpoints. No concrete malicious behavior was found.
Evidence
dist/index.js
Network endpoints10
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest publishes dist/index.js and has no lifecycle scripts.
- The declared API loads the widget as part of an explicit render call.
- On widget load failure, the runtime sends error telemetry to environment-specific Zerohash collectors.
- The telemetry payload contains app, session, browser, page, and selected JWT claim metadata; the request body is that payload, not the JWT itself.
- The widget script URLs point to Zerohash CDN hosts.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg90async render(container: HTMLElement): Promise<void> {
// Validate container
if (!container || !(container instanceof HTMLElement)) {
throw new Error(this.errorMessages.INVALID_CONTAINER
Low
Ai Review Evidence
The declared API loads the widget as part of an explicit render call.
dist/index.d.tsView on unpkg · L90package.jsonView file
1{
"name": "@zerohash-sdk/travel-rule-js",
"version": "0.7.7",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.umd.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "travel-rule-js"
}
}
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-js@0.7.7.
See all versions of @zerohash-sdk/travel-rule-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-js@0.7.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.