@atlasauth/embed@0.1.1
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe static finding reflects expected authentication-widget behavior, including anti-bot telemetry, rather than a concrete account-hijack or malicious execution path. There are no lifecycle hooks or source signs of hidden execution, persistence, or unrelated data exfiltration.
Decision evidence
public snapshot- The manifest contains build, typecheck, and test scripts only; it has no automatic install lifecycle hook.
- The browser bundle records device and interaction metrics for an anti-bot telemetry request when an authentication action occurs.
- Social sign-in starts only from a button click and calls the authentication flow.
- No package-install execution, shell execution, filesystem access, or persistence mechanism was found.
- The telemetry endpoint is constructed from the embedding application's configured frontend API, not a hard-coded third-party host.
- The reviewed social-login code is a conventional user-triggered OAuth and Google identity flow.
Source & flagged code
5 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L1The browser bundle records device and interaction metrics for an anti-bot telemetry request when an authentication action occurs.
dist/embed.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @atlasauth/embed@0.1.1.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.