registry / @atlasauth/embed / 0.9.0
@atlasauth/embed@0.9.0
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe flagged runtime locations resolve to authentication flows, popup signaling, design helpers, and telemetry sent to the widget's configured frontend API. The reviewed manifest and dependency entrypoints show no install hook or concrete attack behavior.
Static reason
No blocking static signals were detected.
Trigger
Using the widget for sign-in or sign-up triggers telemetry.
Impact
No confirmed unrelated account change, credential disclosure to a separate recipient, or other attack impact was established.
Mechanism
Telemetry contains device details and an optional interaction snapshot and is sent to the frontend API passed through the widget options. The inspected authentication callers use Atlas client routes for their respective flows.
AI rationale
The flagged runtime locations resolve to authentication flows, popup signaling, design helpers, and telemetry sent to the widget's configured frontend API. The reviewed manifest and dependency entrypoints show no install hook or concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the package entrypoint and lists Atlas authentication and design dependencies; the inspected manifest has no install lifecycle hook.
- Telemetry collects device details and an optional interaction snapshot, then posts them to the frontend API supplied through the widget options.
- Inspected sign-in, sign-up, reset, MFA, SSO, and passkey callers send their corresponding user-entered values or authentication results to Atlas client routes; no unrelated account mutation was identified.
- The inspected popup, sign-out, appearance, and design runtime helpers handle authentication flow messages or design rendering.
- The inspected @atlasauth/js manifest points to dist/index.js, declares @atlasauth/authz 0.2.0, and lists build, typecheck, and test scripts without an install lifecycle script.
Evidence against
- Telemetry includes device identifiers and may include an interaction snapshot; the inspected caller routes it to the configured frontend API.
Behavioral surface
Network
Source & flagged code
7 flaggeddist/embed.jsView file
1"use strict";(()=>{var Wa=Object.create;var Pt=Object.defineProperty;var Ha=Object.getOwnPropertyDescriptor;var ja=Object.getOwnPropertyNames;var Ka=Object.getPrototypeOf,Ga=Object...
L2: `)}
L3: `}async function _r(e){var n;let t=(n=globalThis.navigator)==null?void 0:n.clipboard;if(!(t!=null&&t.writeText))return!1;try{return await t.writeText(e.join(`
L4: `)),!0}catch{return!1}}function Ut(){return typeof document!="undefined"&&typeof Blob!="undefined"&&typeof URL!="undefined"&&typeof URL.createObjectURL=="function"}function xr(e,t=...
L5: self.onmessage = async function (e) {
...
L386: @keyframes atlas-embed-pulse { 0%,100% { opacity: 0.4; } 50% { opacity: 1; } }
L387: `;function na(e=document){var n;if(e.querySelector(`style[data-${ta}]`))return;let t=e.createElement("style");t.setA
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/embed.jsView on unpkg · L1387Nr({api:e.options.frontendApi,publishableKey:e.options.publishableKey,attemptId:t!=null?t:void 0,kind:e.mode==="sign-up"?"sign_up":"sign_in",recorder:e.recorder,fetchImpl:e.options
Low
Ai Review Evidence
Telemetry collects device details and an optional interaction snapshot, then posts them to the frontend API supplied through the widget options.
dist/embed.jsView on unpkg · L387Findings
2 High1 Medium9 Low
HighBrowser Session Account Hijackdist/embed.js
HighSemantic Analysis Limiteddist/widget/social.js#virtual:normalized:round1
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/embed.js
LowAi Review Evidencedist/appearance.js
LowAi Review Evidence.lpm-dependency-evidence-2a734698-e5f3-4670-a520-1addba593794/0/npm-linux/dist/sign-out-guard.js
LowAi Review Evidence.lpm-dependency-evidence-2a734698-e5f3-4670-a520-1addba593794/0/npm-linux/dist/popup-channel.js
Affected versions and remediation
This report applies to @atlasauth/embed@0.9.0.
See all versions of @atlasauth/embed for other recorded verdicts.
- Review the evidence and your use of @atlasauth/embed@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.