registry / @zerohash-sdk/travel-rule-js / 0.7.8
@zerohash-sdk/travel-rule-js@0.7.8
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no lifecycle scripts, and the runtime behavior inspected is a user-invoked widget loader with failure diagnostics sent to fixed Zerohash collectors. No concrete malicious behavior was established.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render(), and the widget script fails to load.
Impact
The collector receives operational diagnostic context; inspected source does not establish credential export or unrelated account changes.
Mechanism
The runtime builds an error report from application, session, browser, page-origin, and failure details, then posts it to a fixed environment-specific collector.
AI rationale
The manifest has no lifecycle scripts, and the runtime behavior inspected is a user-invoked widget loader with failure diagnostics sent to fixed Zerohash collectors. No concrete malicious behavior was established.
Evidence
package.jsondist/index.d.tsdist/index.js
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares dist entrypoints and no lifecycle scripts.
- dist/index.d.ts describes loading the widget with environment, collector URLs, and a caller-provided JWT.
- dist/index.js sends diagnostic reports only when widget script loading fails; the report includes app, session, browser, page-origin, and error context.
- The diagnostic collector URLs are fixed Zerohash domains, and the request body is the constructed diagnostic payload.
- The runtime loader and widget setup are activated by render().
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg235collectorUrls: FARO_COLLECTOR_URLS,
env: this.getEnvironment(),
jwt: this.config.jwt,
onLoad: resolve,
onError: (info) => {
reject(
Low
Ai Review Evidence
dist/index.d.ts describes loading the widget with environment, collector URLs, and a caller-provided JWT.
dist/index.d.tsView on unpkg · L235package.jsonView file
5ule",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.umd.js",
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-js@0.7.8.
See all versions of @zerohash-sdk/travel-rule-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-js@0.7.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.