@atlasauth/embed@0.8.0
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection supports ordinary authentication widget behavior: the manifest has no install hook, and the reviewed browser callers route user-entered credentials through client authentication operations. The scanner’s account-hijack hint was not borne out by the inspected paths.
Decision evidence
public snapshot- The manifest declares a module entrypoint and Atlas dependencies, with no install lifecycle script; the inspected dependency entrypoints export library code.
- The inspected browser callers send credentials and authentication-flow data through Atlas client methods to client authentication routes. The sign-up request carries the entered email and password; no transfer of saved service credentials to an unrelated recipient was identified.
- The inspected runtime paths handle sign-out notifications, OAuth popup messages, captcha sign-up, and social login UI. No unrelated account change or confirmed attack surface was identified.
Source & flagged code
7 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L1The inspected browser callers send credentials and authentication-flow data through Atlas client methods to client authentication routes. The sign-up request carries the entered email and password; no transfer of saved service credentials to an unrelated recipient was identified.
dist/embed.jsView on unpkg · L382Findings
Affected versions and remediation
This report applies to @atlasauth/embed@0.8.0.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.