registry / @zerohash-sdk/travel-rule-react / 0.5.2
@zerohash-sdk/travel-rule-react@0.5.2
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser-side React wrapper that deliberately loads a Zerohash travel-rule web component from vendor CDN endpoints. Source inspection found no install hook or concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the TravelRule React component.
Impact
The selected Zerohash CDN module executes in the host browser, as expected for this wrapper.
Mechanism
Dynamic vendor module loading with failure telemetry.
AI rationale
The package is a browser-side React wrapper that deliberately loads a Zerohash travel-rule web component from vendor CDN endpoints. Source inspection found no install hook or concrete malicious behavior.
Network endpoints6
sdk-cdn.dev.0hash.comsdk-cdn.cert.zerohash.comsdk-cdn.zerohash.comsdk-cdn.cert.zerohash.eusdk-cdn.zerohash.eugrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The React component dynamically injects a module script from configured Zerohash CDN URLs when rendered.
- The manifest exposes a browser React entrypoint and contains no lifecycle scripts or executable installer configuration.
Evidence against
- No install-time hook, shell execution, filesystem access, credential harvesting, or persistence logic was found.
- Telemetry is limited to failed script-load reports sent to Zerohash collector endpoints.
- The remote script loader is component-render-triggered and consistent with a web-component wrapper.
Behavioral surface
Network
UrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg1{
"name": "@zerohash-sdk/travel-rule-react",
"version": "0.5.2",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
Low
Suspicious Lifecycle Evidence
The manifest exposes a browser React entrypoint and contains no lifecycle scripts or executable installer configuration.
package.jsonView on unpkg · L1dist/index.jsView file
124}, w = (u, y) => {
S(), T = performance.now();
const l = document.createElement("script");
l.id = d, l.src = u, l.type = "module", l.async = !0, l.onload = () => {
setTimeout(() => {
m || (customElements.get(t) ? (m = !0, S(), _?.()) : x("not-defined", u, y));
}, 0);
}, l.onerror = () => x("network", u, y), k = setTimeout(() => x("timeout", u, y), g), document.getElementById(d)?.remove(), document.head.appendChild(l);
Findings
1 High1 Medium3 Low
HighSemantic Analysis Limitedpackage.json
MediumNetwork
LowUrl Strings
LowAi Review Evidencedist/index.js
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-react@0.5.2.
See all versions of @zerohash-sdk/travel-rule-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-react@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.