registry / @atlasauth/embed / 0.10.0
@atlasauth/embed@0.10.0
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected bundle implements browser authentication flows and sends device and interaction telemetry to the frontend API supplied through embed configuration. I found no unrelated credential recipient, unrequested account mutation, or install-time behavior.
Static reason
No blocking static signals were detected.
Trigger
A user starts or submits a sign-in or sign-up flow.
Impact
No unrelated credential recipient, unrequested account change, or install-time action was identified in the inspected source.
Mechanism
The widget sends authentication requests and telemetry to its configured frontend API; credentialed requests use that same configured API base URL.
AI rationale
The inspected bundle implements browser authentication flows and sends device and interaction telemetry to the frontend API supplied through embed configuration. I found no unrelated credential recipient, unrequested account mutation, or install-time behavior.
Network endpoints3
/v1/client/telemetry/v1/client/sign_ups/v1/client/tickets/exchange
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no lifecycle scripts and depends on the Atlas design and client packages.
- The widget sends user-entered sign-up data and authentication-flow requests to its configured frontend API; the inspected callers cover sign-in, sign-up, recovery, passkey, and second-factor flows.
- Authentication telemetry contains device and interaction data and is sent to the configured frontend API. The API origin comes from embed configuration, and credentialed requests use that same configured base URL.
- The supporting source implements OAuth popup handling, user-triggered social sign-in, sign-out observation, MFA rendering, and design helpers.
Evidence against
Behavioral surface
Network
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/embed.jsView file
1"use strict";(()=>{var Vs=Object.create;var Pt=Object.defineProperty;var Gs=Object.getOwnPropertyDescriptor;var Ys=Object.getOwnPropertyNames;var Js=Object.getPrototypeOf,Zs=Object...
L2: `)}
L3: `}async function _r(e){var n;let t=(n=globalThis.navigator)==null?void 0:n.clipboard;if(!(t!=null&&t.writeText))return!1;try{return await t.writeText(e.join(`
L4: `)),!0}catch{return!1}}function Ut(){return typeof document!="undefined"&&typeof Blob!="undefined"&&typeof URL!="undefined"&&typeof URL.createObjectURL=="function"}function xr(e,t=...
L5: self.onmessage = async function (e) {
...
L386: @keyframes atlas-embed-pulse { 0%,100% { opacity: 0.4; } 50% { opacity: 1; } }
L387: `;function as(e=document){var n;if(e.querySelector(`style[data-${ss}]`))return;let t=e.createElement("style");t.setA
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L14ject.keys(t.fields).length>0,r=await e.post("/v1/client/sign_ups",{email:t.email,password:t.password,...n?{fields:t.fields}:{},...t.consent?{consent:!
Low
Ai Review Evidence
The widget sends user-entered sign-up data and authentication-flow requests to its configured frontend API; the inspected callers cover sign-in, sign-up, recovery, passkey, and second-factor flows.
dist/embed.jsView on unpkg · L4Findings
2 High1 Medium9 Low
HighBrowser Session Account Hijackdist/embed.js
HighSemantic Analysis Limiteddist/widget/social.js#virtual:normalized:round1
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/embed.js
LowAi Review Evidencedist/appearance.js
LowAi Review Evidence.lpm-dependency-evidence-5170edcc-3af4-410b-bf77-e9627a41d469/1/npm-linux/dist/sign-out-guard.js
LowAi Review Evidence.lpm-dependency-evidence-5170edcc-3af4-410b-bf77-e9627a41d469/1/npm-linux/dist/popup-channel.js
Affected versions and remediation
This report applies to @atlasauth/embed@0.10.0.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.