registry / @atlasauth/embed / 0.11.0
@atlasauth/embed@0.11.0
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe flagged credential and account-related code participates in widget-driven authentication, and the signup caller sends entered form data and policy acceptances to the client API. The reviewed manifest and runtime excerpts do not establish a malicious install hook, unrelated credential transfer, or unrequested account mutation.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports and mounts the widget, and a user starts an authentication flow.
Impact
The inspected source does not establish an unrelated credential recipient or an unrequested account change.
Mechanism
The widget sends form data to its client API and presents consent, sign-in, MFA, and recovery steps; inspected helpers relay popup results and sign-out messages.
AI rationale
The flagged credential and account-related code participates in widget-driven authentication, and the signup caller sends entered form data and policy acceptances to the client API. The reviewed manifest and runtime excerpts do not establish a malicious install hook, unrelated credential transfer, or unrequested account mutation.
Evidence
package.jsondist/embed.jsdist/appearance.jsdist/widget/policies.jsdist/widget/mfa.jsdist/widget/forms.jsdist/widget/render.jsdist/widget/social.js.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/0/npm-linux/package.json.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/0/npm-linux/dist/runtime.js.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/package.json.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/index.js.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/sign-out-guard.js.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/popup-channel.js.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/fapi.js.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/policy-dom.js
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the package entrypoint, lists the two authentication dependencies, and has no install lifecycle script.
- Sign-up sends the supplied email, password, and consent data to the client sign-up route; its helper and caller pass through user form values and policy acceptances.
- The widget gates sign-up on policy consent and renders policy acceptance as a user-facing step; other inspected flows handle MFA, CAPTCHA, sign-in, recovery, and SSO.
- The inspected dependency code exports UI helpers, provides popup OAuth result relaying, and watches for sign-out messages from another tab.
Evidence against
Behavioral surface
Network
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/embed.jsView file
1"use strict";(()=>{var Ts=Object.create;var Mt=Object.defineProperty;var Is=Object.getOwnPropertyDescriptor;var Os=Object.getOwnPropertyNames;var Ls=Object.getPrototypeOf,Ds=Object...
L2: `)}
L3: `}async function jr(e){var n;let t=(n=globalThis.navigator)==null?void 0:n.clipboard;if(!(t!=null&&t.writeText))return!1;try{return await t.writeText(e.join(`
L4: `)),!0}catch{return!1}}function jt(){return typeof document!="undefined"&&typeof Blob!="undefined"&&typeof URL!="undefined"&&typeof URL.createObjectURL=="function"}function Kr(e,t=...
L5: `).split(`
...
L409: @keyframes atlas-embed-pulse { 0%,100% { opacity: 0.4; } 50% { opacity: 1; } }
L410: `;function Ni(e=document){var n;if(e.querySelector(`style[data-${zi}]`))return;let t=e.createElement("style");t.setAttribute(`data-${zi}`,""),t
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L17length>0,r=await e.post("/v1/client/sign_ups",{email:t.email,password:t.password,...n?{fields:t.fields}:{},...t.consent?{consent:!0}:{},...t.captchaTo
Low
Ai Review Evidence
Sign-up sends the supplied email, password, and consent data to the client sign-up route; its helper and caller pass through user form values and policy acceptances.
dist/embed.jsView on unpkg · L7Findings
2 High1 Medium9 Low
HighBrowser Session Account Hijackdist/embed.js
HighSemantic Analysis Limiteddist/widget/social.js#virtual:normalized:round1
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/embed.js
LowSuspicious Lifecycle Evidencedist/appearance.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/sign-out-guard.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-5129b4b5-f53f-4b25-a522-7df81e4af67a/1/npm-linux/dist/popup-channel.js
Affected versions and remediation
This report applies to @atlasauth/embed@0.11.0.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.