@zerohash-sdk/travel-rule-react@0.7.12
This library was generated with [Nx](https://nx.dev).
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe widget’s hosted script and failure diagnostics fit its travel-rule purpose, but the automatic report includes the page origin and participant-related JWT claims. This undisclosed runtime telemetry warrants a warning.
Decision evidence
public snapshot- On widget load failure, the package automatically reports diagnostics to Zerohash’s Grafana Faro collector.
- The report includes the browser user agent, page origin, and participant and platform claims decoded from the supplied JWT.
- The report is triggered by widget loading errors, including network failures and timeouts, when the React component is used.
- The report sends a JSON POST with a generated session ID; the package provides no documented way to disable this reporting.
- The package is a React wrapper for Zerohash’s travel-rule widget, and loading its hosted web component is consistent with that purpose.
- Reporting is limited to widget load failures; the reviewed source does not send the JWT itself or show install-time network activity.
Source & flagged code
6 flaggedOn widget load failure, the package automatically reports diagnostics to Zerohash’s Grafana Faro collector.
dist/index.jsView on unpkg · L7On widget load failure, the package automatically reports diagnostics to Zerohash’s Grafana Faro collector.
dist/index.jsView on unpkg · L107The report includes the browser user agent, page origin, and participant and platform claims decoded from the supplied JWT.
Findings
Affected versions and remediation
This report applies to @zerohash-sdk/travel-rule-react@0.7.12.
See all versions of @zerohash-sdk/travel-rule-react for other recorded verdicts.
- Review the evidence and your use of @zerohash-sdk/travel-rule-react@0.7.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.