registry / @zerohash-sdk/travel-rule-js / 0.7.9
@zerohash-sdk/travel-rule-js@0.7.9
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest exposes a browser SDK with no lifecycle hooks. Source inspection shows user-triggered component loading and failure-only diagnostics sent to Zerohash-hosted collectors; no malicious behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render(), followed by a component script-load failure.
Impact
The collector receives failure diagnostics and limited context; the inspected payload does not transmit the JWT.
Mechanism
The SDK creates a diagnostic payload from the failure context and browser metadata, then posts it to the regional collector selected by environment and JWT region claims.
AI rationale
The manifest exposes a browser SDK with no lifecycle hooks. Source inspection shows user-triggered component loading and failure-only diagnostics sent to Zerohash-hosted collectors; no malicious behavior was identified.
Network endpoints5
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the browser SDK entry points and has no lifecycle scripts.
- The declaration routes component loading and the configured JWT to the loader when the SDK runs.
- The built SDK uses Zerohash-hosted regional CDN and collector URLs.
- The collector payload contains load-failure details and limited app, browser, page, and JWT-claim metadata; it does not include the JWT itself.
- The SDK POSTs that payload to the selected collector, and the reporting callback is used for script-load failures.
- The component script is added to the document head by the loader; no independent install-time or import-time action was identified.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg234scriptUrls: this.getEffectiveScriptUrls(),
collectorUrls: FARO_COLLECTOR_URLS,
env: this.getEnvironment(),
jwt: this.config.jwt,
onLoad: resolve,
onError: (info) => {
Low
Ai Review Evidence
The declaration routes component loading and the configured JWT to the loader when the SDK runs.
dist/index.d.tsView on unpkg · L234package.jsonView file
1{
"name": "@zerohash-sdk/travel-rule-js",
"version": "0.7.9",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-js@0.7.9.
See all versions of @zerohash-sdk/travel-rule-js for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-js@0.7.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.