registry / @authagonal/login / 0.6.0

@authagonal/login@0.6.0

⚠ Under review

Default login UI for Authagonal — runtime-configurable via branding.json

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 390 KB of source, external domains: authagonal.io, challenges.cloudflare.com, locize.com, www.i18next.com, www.w3.org

Source & flagged code

9 flagged

dist/index.jsView file

Lines 3828-3868javascript

3828 let e = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : this.options.order, t = [];

3829 return e.forEach((e) => {

3830 if (this.detectors[e]) {

3831 let n = this.detectors[e].lookup(this.options);

3832 n && typeof n == "string" && (n = [n]), n && (t = t.concat(n));

3833 }

3834 }), t = t.filter((e) => e != null && !Wr(e)).map((e) => this.options.convertDetectedLanguage(e)), this.services && this.services.languageUtils && this.services.languageUtils.getBestMatchFromCodes ? t : t.length > 0

3835 }

3836 cacheUserLanguage(e) {

3837 let t = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : this.options.caches;

3838 t && (this.options.excludeCacheFor && this.options.excludeCacheFor.indexOf(e) > -1 || t.forEach((t) => {

3839 this.detectors[t] && this.detectors[t].cacheUserLanguage(e, this.options);

3840 }));

3841 }

3842};

3843ui.type = "languageDetector";

3844var di = {

3845 poweredBy: "Powered by <brand>Authagonal</brand>",

3846 signIn: "Sign in",

3847 email: "Email",

3848 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3848

3849 emailPlaceholder: "you@example.com",

3850 passwordPlaceholder: "Enter your password",

3851 signingIn: "Signing in...",

3852 forgotPassword: "Forgot password?",

3853 ssoChecking: "Checking sign-in options...",

3854 ssoNotice: "Your organization uses single sign-on",

3855 continueWithSso: "Continue with SSO",

3856 errorInvalidCredentials: "Invalid email or password",

3857 errorLockedOut: "Account locked. Try again in {{seconds}} seconds",

3858 errorEmailNotConfirmed: "Please check your email to verify your account",

3859 errorSsoRequired: "Single sign-on is required for this account",

3860 errorEmailRequired: "Email is required",

3861 errorPasswordRequired: "Password is required",

3862 errorUnexpected: "An unexpected error occurred. Please try again.",

3863 captchaFailed: "Verification failed. Please try again.",

3864 resetYourPassword: "Reset your password",

3865 resetSubtitle: "Enter your email address and we'll send you a link to reset your password.",

3866 sending: "Sending...",

3867 sendResetLink: "Send reset link",

3868 backToSignIn: "Back to sign in",

Lines 4103-4143javascript

4103 errorWeakPassword: "密码不符合要求。",

4104 errorEmailAndPasswordRequired: "邮箱和密码为必填项。",

4105 errorRegistrationFailed: "注册失败，请重试。",

4106 "account.title": "账户",

4107 "account.subtitle": "管理您的个人资料和首选语言。",

4108 "account.backToApp": "返回{{app}}",

4109 "account.signInPrompt"

Lines 4229-4269javascript

4229 errorWeakPassword: "Das Passwort erfüllt nicht die Anforderungen.",

4230 errorEmailAndPasswordRequired: "E-Mail und Passwort sind erforderlich.",

4231 errorRegistrationFailed: "Registrierung fehlgeschlagen. Bitte versuchen Sie es erneut.",

4232 "account.title": "Konto",

4233 "account.subtitle": "Verwalten Sie Ihr Profil und Ihre bevorzugte Sprache.",

4234 "account.backToApp": "Zurück zu {{app}}",

Lines 4355-4395javascript

4355 errorWeakPassword: "Le mot de passe ne respecte pas les exigences.",

4356 errorEmailAndPasswordRequired: "L'e-mail et le mot de passe sont requis.",

4357 errorRegistrationFailed: "L'inscription a échoué. Veuillez réessayer.",

4358 "account.title": "Compte",

4359 "account.subtitle": "Gérez votre profil et votre langue préférée.",

4360 "account.backToApp": "Retour à {{app}}",

Lines 4481-4521javascript

4481 errorWeakPassword: "La contraseña no cumple los requisitos.",

4482 errorEmailAndPasswordRequired: "El correo y la contraseña son obligatorios.",

4483 errorRegistrationFailed: "Error en el registro. Inténtalo de nuevo.",

4484 "account.title": "Cuenta",

4485 "account.subtitle": "Administra tu perfil y tu idioma preferido.",

4486 "account.backToApp": "Volver a {{app}}",

4487

Lines 4733-4782javascript

4733 errorWeakPassword: "A palavra-passe não cumpre os requisitos.",

4734 errorEmailAndPasswordRequired: "E-mail e palavra-passe são obrigatórios.",

4735 errorRegistrationFailed: "O registo falhou. Tente novamente.",

4736 "account.title": "Conta",

4737 "account.subtitle": "Faça a gestão do seu perfil e do seu idioma preferido.",

4738 "account.backToApp": "Voltar para {{app}}",

Lines 5040-5080javascript

5040 label: "Tiếng Việt",

5041 resource: gi

5042 },

5043 {

5044 code: "pt",

5045 label: "Português",

5046 resource: _i

5047 },

5048 {

5049 code

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/index.jsView file

4762contains invisible/control Unicode U+2068 (first strong isolate) errorLockedOut: "تم قفل الحساب. أعد المحاولة خلال <U+2068>{{seconds}}<U+2069> ثانية",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L4762

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

4123patternName = generic_password severity = medium line = 4123 matchedText = password...rt",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L4123

3848patternName = generic_password severity = medium line = 3848 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3848

4249patternName = generic_password severity = medium line = 4249 matchedText = password...se",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4249

4375patternName = generic_password severity = medium line = 4375 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4375

4501patternName = generic_password severity = medium line = 4501 matchedText = password...ẩu",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4501

4753patternName = generic_password severity = medium line = 4753 matchedText = password...ور",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L4753

5060patternName = generic_password severity = medium line = 5060 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L5060

Findings

2 Critical10 Medium3 Low

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/index.jsView file

Lines 3828-3868javascript

3828 let e = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : this.options.order, t = [];

3829 return e.forEach((e) => {

3830 if (this.detectors[e]) {

3831 let n = this.detectors[e].lookup(this.options);

3832 n && typeof n == "string" && (n = [n]), n && (t = t.concat(n));

3833 }

3835 }

3836 cacheUserLanguage(e) {

3837 let t = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : this.options.caches;

3838 t && (this.options.excludeCacheFor && this.options.excludeCacheFor.indexOf(e) > -1 || t.forEach((t) => {

3839 this.detectors[t] && this.detectors[t].cacheUserLanguage(e, this.options);

3840 }));

3841 }

3842};

3843ui.type = "languageDetector";

3844var di = {

3845 poweredBy: "Powered by <brand>Authagonal</brand>",

3846 signIn: "Sign in",

3847 email: "Email",

3848 password: "Password",

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L3848

3849 emailPlaceholder: "you@example.com",

3850 passwordPlaceholder: "Enter your password",

3851 signingIn: "Signing in...",

3852 forgotPassword: "Forgot password?",

3853 ssoChecking: "Checking sign-in options...",

3854 ssoNotice: "Your organization uses single sign-on",

3855 continueWithSso: "Continue with SSO",

3856 errorInvalidCredentials: "Invalid email or password",

3857 errorLockedOut: "Account locked. Try again in {{seconds}} seconds",

3858 errorEmailNotConfirmed: "Please check your email to verify your account",

3859 errorSsoRequired: "Single sign-on is required for this account",

3860 errorEmailRequired: "Email is required",

3861 errorPasswordRequired: "Password is required",

3862 errorUnexpected: "An unexpected error occurred. Please try again.",

3863 captchaFailed: "Verification failed. Please try again.",

3864 resetYourPassword: "Reset your password",

3865 resetSubtitle: "Enter your email address and we'll send you a link to reset your password.",

3866 sending: "Sending...",

3867 sendResetLink: "Send reset link",

3868 backToSignIn: "Back to sign in",

Lines 4103-4143javascript

4103 errorWeakPassword: "密码不符合要求。",

4104 errorEmailAndPasswordRequired: "邮箱和密码为必填项。",

4105 errorRegistrationFailed: "注册失败，请重试。",

4106 "account.title": "账户",

4107 "account.subtitle": "管理您的个人资料和首选语言。",

4108 "account.backToApp": "返回{{app}}",

4109 "account.signInPrompt"

Lines 4229-4269javascript

4229 errorWeakPassword: "Das Passwort erfüllt nicht die Anforderungen.",

4230 errorEmailAndPasswordRequired: "E-Mail und Passwort sind erforderlich.",

4231 errorRegistrationFailed: "Registrierung fehlgeschlagen. Bitte versuchen Sie es erneut.",

4232 "account.title": "Konto",

4233 "account.subtitle": "Verwalten Sie Ihr Profil und Ihre bevorzugte Sprache.",

4234 "account.backToApp": "Zurück zu {{app}}",

Lines 4355-4395javascript

4355 errorWeakPassword: "Le mot de passe ne respecte pas les exigences.",

4356 errorEmailAndPasswordRequired: "L'e-mail et le mot de passe sont requis.",

4357 errorRegistrationFailed: "L'inscription a échoué. Veuillez réessayer.",

4358 "account.title": "Compte",

4359 "account.subtitle": "Gérez votre profil et votre langue préférée.",

4360 "account.backToApp": "Retour à {{app}}",

Lines 4481-4521javascript

4481 errorWeakPassword: "La contraseña no cumple los requisitos.",

4482 errorEmailAndPasswordRequired: "El correo y la contraseña son obligatorios.",

4483 errorRegistrationFailed: "Error en el registro. Inténtalo de nuevo.",

4484 "account.title": "Cuenta",

4485 "account.subtitle": "Administra tu perfil y tu idioma preferido.",

4486 "account.backToApp": "Volver a {{app}}",

4487

Lines 4733-4782javascript

4733 errorWeakPassword: "A palavra-passe não cumpre os requisitos.",

4734 errorEmailAndPasswordRequired: "E-mail e palavra-passe são obrigatórios.",

4735 errorRegistrationFailed: "O registo falhou. Tente novamente.",

4736 "account.title": "Conta",

4737 "account.subtitle": "Faça a gestão do seu perfil e do seu idioma preferido.",

4738 "account.backToApp": "Voltar para {{app}}",

Lines 5040-5080javascript

5040 label: "Tiếng Việt",

5041 resource: gi

5042 },

5043 {

5044 code: "pt",

5045 label: "Português",

5046 resource: _i

5047 },

5048 {

5049 code

•Trigger-reachable chain: manifest.main -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg