@atlasauth/embed@0.15.0
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically reports device fingerprint and interaction telemetry during authentication, and the inspected source does not disclose or expose a way to disable it. The destination is the configured authentication API and the data is not credentials, so this is a privacy warning rather than clear malicious exfiltration.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user submits an authentication form.
Impact
The service receives persistent or pseudonymous browser/device characteristics and interaction patterns, creating a privacy risk.
Mechanism
The widget sends a device ID, fingerprint, browser/device properties, and aggregate interaction measurements to the configured API’s `/v1/client/telemetry` endpoint.
AI rationale
The package automatically reports device fingerprint and interaction telemetry during authentication, and the inspected source does not disclose or expose a way to disable it. The destination is the configured authentication API and the data is not credentials, so this is a privacy warning rather than clear malicious exfiltration.
Evidence
dist/embed.js
Network endpoints1
Configured frontend API: `/v1/client/telemetry?publishable_key=…`
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The telemetry request sends a device ID, device fingerprint, device properties, and interaction behavior to `/v1/client/telemetry`.
- The device data includes screen dimensions; the behavior summary includes typing and interaction timing counts.
- An authentication form submission triggers telemetry before the authentication request.
Evidence against
- The telemetry is sent to the configured frontend API, consistent with the package’s authentication purpose.
- The manifest has no install, preinstall, or postinstall hook.
- The flagged organization admin UI uses explicit controls for account changes; no default account mutation was identified.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/embed.jsView file
1"use strict";(()=>{var Ma=Object.create;var fn=Object.defineProperty;var Ua=Object.getOwnPropertyDescriptor;var za=Object.getOwnPropertyNames;var Na=Object.getPrototypeOf,Ba=Object...
L2: `)}
L3: `}async function Eo(e){var n;let t=(n=globalThis.navigator)==null?void 0:n.clipboard;if(!(t!=null&&t.writeText))return!1;try{return await t.writeText(e.join(`
L4: `)),!0}catch{return!1}}function Cn(){return typeof document!="undefined"&&typeof Blob!="undefined"&&typeof URL!="undefined"&&typeof URL.createObjectURL=="function"}function Ro(e,t=...
L5: `).split(`
...
L412: @keyframes atlas-embed-pulse { 0%,100% { opacity: 0.4; } 50% { opacity: 1; } }
L413: `,js=new WeakSet;function Hs(e=document){var n;if(js.has(e)||e.querySelector(`style[data-${Or}]`))return;if(rn(e,Or,Bs)){js.add(e);return}let t
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = @atlasauth/embed@0.13.0
matchedIdentity = npm:QGF0bGFzYXV0aC9lbWJlZA:0.13.0
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/embed.jsView on unpkgFindings
3 High5 Medium4 Low
HighBrowser Session Account Hijackdist/embed.js
HighSemantic Analysis Limiteddist/widget/social.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/embed.js
MediumNetwork
MediumAi Review Evidencedist/embed.js
MediumAi Review Evidencedist/embed.js
MediumAi Review Evidencedist/embed.js
MediumAi Review Evidencedist/embed.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @atlasauth/embed@0.15.0.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.