registry / @atlasauth/embed / 0.5.2
@atlasauth/embed@0.5.2
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected runtime calls match the package’s authentication widget behavior. The credential-related caller locations resolve to authentication flows using configured API values; no concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Consumers configure and mount the widget; authentication requests occur when its flows are used.
Impact
No unauthorized account change or transfer to a package-selected unrelated recipient was established.
Mechanism
The widget sends sign-in and related requests to its configured API. The inspected passkey control starts its flow on a user click.
AI rationale
The manifest has no install lifecycle hook, and the inspected runtime calls match the package’s authentication widget behavior. The credential-related caller locations resolve to authentication flows using configured API values; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to dist/index.js and defines build, typecheck, and test scripts, with no install lifecycle hook; dist/index.js exports the widget API.
- dist/embed.js sends authentication requests through the configured frontend API, and configuration requires a publishable key and frontend API value.
- The reviewed runtime locations implement sign-in, sign-up, recovery, reset, provider authentication, and session completion flows.
- The passkey button starts authentication from a user click.
Evidence against
Behavioral surface
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/embed.jsView file
1"use strict";(()=>{var Yr=Object.create;var rt=Object.defineProperty;var Jr=Object.getOwnPropertyDescriptor;var Zr=Object.getOwnPropertyNames;var Xr=Object.getPrototypeOf,Qr=Object...
L2: .atlas-embed-root {
...
L370: @keyframes atlas-embed-pulse { 0%,100% { opacity: 0.4; } 50% { opacity: 1; } }
L371: `;function hr(e=document){var n;if(e.querySelector(`style[data-${br}]`))return;let t=e.createElement("style");t.setAttribute(`data-${br}`,""),t.textContent=ua,((n=e.head)!=null?n:e...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L11){return an(this.options.locale)}get frontendApiOrigin(){let t=this.options.baseUrl;if(!t)return"";try{return new URL(t).origin}catch{return""}}async request(t,n={}){var l,i;let r=
Low
Ai Review Evidence
dist/embed.js sends authentication requests through the configured frontend API, and configuration requires a publishable key and frontend API value.
dist/embed.jsView on unpkg · L1371c=(x=n.atlasPreset)!=null?x:r("preset");return c&&(l.appearance={preset:c}),l}function Kr(e,t={}){var o,a,s,l,i;let n=(o=t.publishableKey)!=null?o:H.publishableKey,r=(a=t.frontendA
Findings
2 High10 Low
HighBrowser Session Account Hijackdist/embed.js
HighSemantic Analysis Limiteddist/widget/social.js#virtual:normalized:round1
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencedist/index.js
LowAi Review Evidencedist/embed.js
LowAi Review Evidencedist/embed.js
LowAi Review Evidencedist/embed.js
Affected versions and remediation
This report applies to @atlasauth/embed@0.5.2.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.