registry / @atlasauth/embed / 0.2.2
@atlasauth/embed@0.2.2
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe source shows a browser authentication widget whose login, social, and passkey flows use the configured Atlas API, with no install hook or verified account-setting mutation. The unusual behavior is device and interaction telemetry sent to that configured API during authentication flows.
Static reason
No blocking static signals were detected.
Trigger
A site mounts the widget and a visitor uses its sign-in or sign-up flow.
Impact
No account-setting mutation or unrelated credential disclosure was established from the inspected source.
Mechanism
Authentication uses the configured frontend API; telemetry reports browser and interaction metadata to that API.
AI rationale
The source shows a browser authentication widget whose login, social, and passkey flows use the configured Atlas API, with no install hook or verified account-setting mutation. The unusual behavior is device and interaction telemetry sent to that configured API during authentication flows.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the browser widget entrypoint and lists only build, typecheck, and test scripts; it has no install lifecycle hook.
- The inspected runtime call sites handle user-facing sign-in, sign-up, password reset, social login, and passkey flows through the widget or Atlas client.
- Telemetry contains a device identifier, device fingerprint, browser characteristics, and interaction metrics, and is sent to the configured frontend API during authentication flows.
- The frontend API is read from widget configuration and is used as the Atlas client base URL.
Evidence against
- The widget sends device and interaction telemetry during authentication flows; this is privacy-relevant collection, but the inspected source routes it to the configured frontend API and does not include entered credentials in the telemetry payload.
Behavioral surface
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/embed.jsView file
1"use strict";(()=>{var ko=Object.create;var Je=Object.defineProperty;var vo=Object.getOwnPropertyDescriptor;var xo=Object.getOwnPropertyNames;var wo=Object.getPrototypeOf,So=Object...
L2: .atlas-embed-root {
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L1dist/widget/social.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/widget/social.js#virtual:normalized:round1View on unpkgdist/widget/passkey.jsView file
Findings
2 High10 Low
HighBrowser Session Account Hijackdist/embed.js
HighSemantic Analysis Limiteddist/widget/social.js#virtual:normalized:round1
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencedist/widget/passkey.js
LowAi Review Evidencedist/widget/passkey.js
LowAi Review Evidencedist/widget/social.js
LowAi Review Evidencedist/widget/render.js
LowAi Review Evidencedist/widget.js
LowAi Review Evidencedist/widget/render.js
Affected versions and remediation
This report applies to @atlasauth/embed@0.2.2.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.