@atlasauth/embed@0.2.0
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks, and the reported runtime callers resolve to authentication, recovery, and session flows. The telemetry collects device and aggregate interaction data for the widget’s configured API; no account hijack or credential disclosure to an unrelated recipient was found.
Decision evidence
public snapshot- package.json contains only build, typecheck, and test scripts; it has no lifecycle hook.
- The runtime code handles sign-in, sign-up, passkey, social login, password reset, and session exchange through the configured frontend API. The inspected callers do not perform account-setting changes, follows, or subscriptions.
- The widget initializes behavioral telemetry and sends device and aggregate interaction metrics to the configured API during authentication flows.
Source & flagged code
8 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L1The widget initializes behavioral telemetry and sends device and aggregate interaction metrics to the configured API during authentication flows.
dist/embed.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @atlasauth/embed@0.2.0.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.