registry / @authagonal/login / 0.4.32

@authagonal/login@0.4.32

⚠ Under review

Default login UI for Authagonal — runtime-configurable via branding.json

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 383 KB of source, external domains: authagonal.io, challenges.cloudflare.com, locize.com, www.i18next.com, www.w3.org

Source & flagged code

9 flagged

dist/index.jsView file

Lines 3828-3868javascript

3828 let e = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : this.options.order, t = [];

3829 return e.forEach((e) => {

3830 if (this.detectors[e]) {

3831 let n = this.detectors[e].lookup(this.options);

3832 n && typeof n == "string" && (n = [n]), n && (t = t.concat(n));

3833 }

3834 }), t = t.filter((e) => e != null && !Ur(e)).map((e) => this.options.convertDetectedLanguage(e)), this.services && this.services.languageUtils && this.services.languageUtils.getBestMatchFromCodes ? t : t.length > 0

3835 }

3836 cacheUserLanguage(e) {

3837 let t = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : this.options.caches;

3838 t && (this.options.excludeCacheFor && this.options.excludeCacheFor.indexOf(e) > -1 || t.forEach((t) => {

3839 this.detectors[t] && this.detectors[t].cacheUserLanguage(e, this.options);

3840 }));

3841 }

3842};

3843li.type = "languageDetector";

3844var ui = {

3845 poweredBy: "Powered by <brand>Authagonal</brand>",

3846 signIn: "Sign in",

3847 email: "Email",

3848 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3848

3849 emailPlaceholder: "you@example.com",

3850 passwordPlaceholder: "Enter your password",

3851 signingIn: "Signing in...",

3852 forgotPassword: "Forgot password?",

3853 ssoChecking: "Checking sign-in options...",

3854 ssoNotice: "Your organization uses single sign-on",

3855 continueWithSso: "Continue with SSO",

3856 errorInvalidCredentials: "Invalid email or password",

3857 errorLockedOut: "Account locked. Try again in {{seconds}} seconds",

3858 errorEmailNotConfirmed: "Please check your email to verify your account",

3859 errorSsoRequired: "Single sign-on is required for this account",

3860 errorEmailRequired: "Email is required",

3861 errorPasswordRequired: "Password is required",

3862 errorUnexpected: "An unexpected error occurred. Please try again.",

3863 captchaFailed: "Verification failed. Please try again.",

3864 resetYourPassword: "Reset your password",

3865 resetSubtitle: "Enter your email address and we'll send you a link to reset your password.",

3866 sending: "Sending...",

3867 sendResetLink: "Send reset link",

3868 backToSignIn: "Back to sign in",

Lines 4099-4139javascript

4099 errorEmailAlreadyRegistered: "此邮箱已注册。",

4100 errorWeakPassword: "密码不符合要求。",

4101 errorEmailAndPasswordRequired: "邮箱和密码为必填项。",

4102 errorRegistrationFailed: "注册失败，请重试。",

4103 "account.title": "账户",

4104 "account.subtitle": "管理您的个人资料和首选语言。",

4105 "account.signInPrompt"

Lines 4223-4263javascript

4223 errorEmailAlreadyRegistered: "Ein Konto mit dieser E-Mail-Adresse existiert bereits.",

4224 errorWeakPassword: "Das Passwort erfüllt nicht die Anforderungen.",

4225 errorEmailAndPasswordRequired: "E-Mail und Passwort sind erforderlich.",

4226 errorRegistrationFailed: "Registrierung fehlgeschlagen. Bitte versuchen Sie es erneut.",

4227 "account.title": "Konto",

4228 "account.subtitle": "Verwalten Sie Ihr Profil und Ihre bevorzugte Sprache.",

Lines 4347-4387javascript

4347 errorEmailAlreadyRegistered: "Un compte avec cet e-mail existe déjà.",

4348 errorWeakPassword: "Le mot de passe ne respecte pas les exigences.",

4349 errorEmailAndPasswordRequired: "L'e-mail et le mot de passe sont requis.",

4350 errorRegistrationFailed: "L'inscription a échoué. Veuillez réessayer.",

4351 "account.title": "Compte",

4352 "account.subtitle": "Gérez votre profil et votre langue préférée.",

Lines 4471-4511javascript

4471 errorEmailAlreadyRegistered: "Ya existe una cuenta con este correo.",

4472 errorWeakPassword: "La contraseña no cumple los requisitos.",

4473 errorEmailAndPasswordRequired: "El correo y la contraseña son obligatorios.",

4474 errorRegistrationFailed: "Error en el registro. Inténtalo de nuevo.",

4475 "account.title": "Cuenta",

4476 "account.subtitle": "Administra tu perfil y tu idioma preferido.",

Lines 4719-4768javascript

4719 errorEmailAlreadyRegistered: "Já existe uma conta com este e-mail.",

4720 errorWeakPassword: "A palavra-passe não cumpre os requisitos.",

4721 errorEmailAndPasswordRequired: "E-mail e palavra-passe são obrigatórios.",

4722 errorRegistrationFailed: "O registo falhou. Tente novamente.",

4723 "account.title": "Conta",

4724 "account.subtitle": "Faça a gestão do seu perfil e do seu idioma preferido.",

Lines 4978-5018javascript

4978 createAccount: "yIchenmoH",

4979 continue: "yItaH",

4980 orSignInWith: "pagh {{provider}} yIlo' yI'el",

4981 registerTitle: "De'wI' yIchenmoH",

4982 firstName: "pong wa'DIch",

4983 firstNamePlaceholder: "worf",

4984 lastName

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/index.jsView file

4748contains invisible/control Unicode U+2068 (first strong isolate) errorLockedOut: "تم قفل الحساب. أعد المحاولة خلال <U+2068>{{seconds}}<U+2069> ثانية",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L4748

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

4119patternName = generic_password severity = medium line = 4119 matchedText = password...rt",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L4119

3848patternName = generic_password severity = medium line = 3848 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3848

4243patternName = generic_password severity = medium line = 4243 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4243

4367patternName = generic_password severity = medium line = 4367 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4367

4491patternName = generic_password severity = medium line = 4491 matchedText = password...ẩu",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4491

4739patternName = generic_password severity = medium line = 4739 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4739

4998patternName = generic_password severity = medium line = 4998 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4998

Findings

2 Critical10 Medium3 Low

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/index.jsView file

Lines 3828-3868javascript

3828 let e = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : this.options.order, t = [];

3829 return e.forEach((e) => {

3830 if (this.detectors[e]) {

3831 let n = this.detectors[e].lookup(this.options);

3832 n && typeof n == "string" && (n = [n]), n && (t = t.concat(n));

3833 }

3835 }

3836 cacheUserLanguage(e) {

3837 let t = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : this.options.caches;

3838 t && (this.options.excludeCacheFor && this.options.excludeCacheFor.indexOf(e) > -1 || t.forEach((t) => {

3839 this.detectors[t] && this.detectors[t].cacheUserLanguage(e, this.options);

3840 }));

3841 }

3842};

3843li.type = "languageDetector";

3844var ui = {

3845 poweredBy: "Powered by <brand>Authagonal</brand>",

3846 signIn: "Sign in",

3847 email: "Email",

3848 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3848

3849 emailPlaceholder: "you@example.com",

3850 passwordPlaceholder: "Enter your password",

3851 signingIn: "Signing in...",

3852 forgotPassword: "Forgot password?",

3853 ssoChecking: "Checking sign-in options...",

3854 ssoNotice: "Your organization uses single sign-on",

3855 continueWithSso: "Continue with SSO",

3856 errorInvalidCredentials: "Invalid email or password",

3857 errorLockedOut: "Account locked. Try again in {{seconds}} seconds",

3858 errorEmailNotConfirmed: "Please check your email to verify your account",

3859 errorSsoRequired: "Single sign-on is required for this account",

3860 errorEmailRequired: "Email is required",

3861 errorPasswordRequired: "Password is required",

3862 errorUnexpected: "An unexpected error occurred. Please try again.",

3863 captchaFailed: "Verification failed. Please try again.",

3864 resetYourPassword: "Reset your password",

3865 resetSubtitle: "Enter your email address and we'll send you a link to reset your password.",

3866 sending: "Sending...",

3867 sendResetLink: "Send reset link",

3868 backToSignIn: "Back to sign in",

Lines 4099-4139javascript

4099 errorEmailAlreadyRegistered: "此邮箱已注册。",

4100 errorWeakPassword: "密码不符合要求。",

4101 errorEmailAndPasswordRequired: "邮箱和密码为必填项。",

4102 errorRegistrationFailed: "注册失败，请重试。",

4103 "account.title": "账户",

4104 "account.subtitle": "管理您的个人资料和首选语言。",

4105 "account.signInPrompt"

Lines 4223-4263javascript

4223 errorEmailAlreadyRegistered: "Ein Konto mit dieser E-Mail-Adresse existiert bereits.",

4224 errorWeakPassword: "Das Passwort erfüllt nicht die Anforderungen.",

4225 errorEmailAndPasswordRequired: "E-Mail und Passwort sind erforderlich.",

4226 errorRegistrationFailed: "Registrierung fehlgeschlagen. Bitte versuchen Sie es erneut.",

4227 "account.title": "Konto",

4228 "account.subtitle": "Verwalten Sie Ihr Profil und Ihre bevorzugte Sprache.",

Lines 4347-4387javascript

4347 errorEmailAlreadyRegistered: "Un compte avec cet e-mail existe déjà.",

4348 errorWeakPassword: "Le mot de passe ne respecte pas les exigences.",

4349 errorEmailAndPasswordRequired: "L'e-mail et le mot de passe sont requis.",

4350 errorRegistrationFailed: "L'inscription a échoué. Veuillez réessayer.",

4351 "account.title": "Compte",

4352 "account.subtitle": "Gérez votre profil et votre langue préférée.",

Lines 4471-4511javascript

4471 errorEmailAlreadyRegistered: "Ya existe una cuenta con este correo.",

4472 errorWeakPassword: "La contraseña no cumple los requisitos.",

4473 errorEmailAndPasswordRequired: "El correo y la contraseña son obligatorios.",

4474 errorRegistrationFailed: "Error en el registro. Inténtalo de nuevo.",

4475 "account.title": "Cuenta",

4476 "account.subtitle": "Administra tu perfil y tu idioma preferido.",

Lines 4719-4768javascript

4719 errorEmailAlreadyRegistered: "Já existe uma conta com este e-mail.",

4720 errorWeakPassword: "A palavra-passe não cumpre os requisitos.",

4721 errorEmailAndPasswordRequired: "E-mail e palavra-passe são obrigatórios.",

4722 errorRegistrationFailed: "O registo falhou. Tente novamente.",

4723 "account.title": "Conta",

4724 "account.subtitle": "Faça a gestão do seu perfil e do seu idioma preferido.",

Lines 4978-5018javascript

4978 createAccount: "yIchenmoH",

4979 continue: "yItaH",

4980 orSignInWith: "pagh {{provider}} yIlo' yI'el",

4981 registerTitle: "De'wI' yIchenmoH",

4982 firstName: "pong wa'DIch",

4983 firstNamePlaceholder: "worf",

4984 lastName

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg