@zerohash-sdk/travel-rule-react@0.7.10
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s purpose explains loading its Zerohash-hosted travel-rule widget, but it also automatically sends failure telemetry containing page-origin and JWT claim metadata, with no documented disclosure or opt-out. The collector is the vendor’s own service and the JWT itself is not sent, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- The React component automatically starts loading the travel-rule web component and uses the built-in collector URLs when none are supplied.
- When loading fails, the loader reports the failure before trying a fallback or showing the error state.
- The reporter sends a JSON POST to the selected collector endpoint.
- The report includes app and environment details, decoded JWT claims, browser user agent, and the current page origin.
- The default collector URLs use Zerohash domains, and the package README does not describe this telemetry.
- The report is limited to a web-component load failure path; the package does not send the JWT itself in the report.
- The collector endpoints belong to Zerohash, consistent with the package’s travel-rule service.
Source & flagged code
7 flaggedThe React component automatically starts loading the travel-rule web component and uses the built-in collector URLs when none are supplied.
dist/index.jsView on unpkg · L284When loading fails, the loader reports the failure before trying a fallback or showing the error state.
dist/index.jsView on unpkg · L103The reporter sends a JSON POST to the selected collector endpoint.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-react@0.7.10.
See all versions of @zerohash-sdk/travel-rule-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-react@0.7.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.