@clerk/clerk-js
Clerk JS library
This report shows the evidence for @clerk/clerk-js@6.42.2. 0 of 28 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package is identified as Clerk's SDK, and the inspected telemetry is disclosed, limited to development instances, and disableable. However, its event payload includes a configured secret-key prefix sent to the telemetry endpoint, which warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
SDK telemetry records an event while running against a development instance; telemetry is enabled by default unless disabled.
Impact
A partial secret-key value is disclosed to the telemetry service; the inspected code does not send the full key in this payload.
Mechanism
The event payload includes the first 16 characters of the configured secret key, then is sent in a POST to the telemetry endpoint.
AI rationale
The package is identified as Clerk's SDK, and the inspected telemetry is disclosed, limited to development instances, and disableable. However, its event payload includes a configured secret-key prefix sent to the telemetry endpoint, which warrants a warning.
Evidence
dist/clerk.js
Network endpoints1
clerk-telemetry.com/v1/event
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The SDK telemetry code adds the first 16 characters of a configured secret key to its event payload.
- Telemetry events are POSTed to https://clerk-telemetry.com/v1/event.
- Telemetry is enabled for development instances by default, though it can be disabled and the SDK displays a telemetry notice with an opt-out link.
Evidence against
- Only a 16-character prefix is included; the inspected code does not send the full configured secret key in this telemetry payload.
- The notice says telemetry applies to development instances and links to opt-out instructions; CLERK_TELEMETRY_DISABLED also disables it.
- The package metadata identifies the expected Clerk JavaScript repository and package directory.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/clerk.jsView file
87package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @base-org/account
L87: ${e.trim()}
L88: (This notice only appears in development)`,te=e=>e7(`${e} as a function is not supported in this environment. The value will be ignored. Provide an absolute URL instead.`),tt={prox...
L89: For more information contact us at ${t}`)}function ao(e){throw Error(`${t7} Calling ${e}.reload is not currently supported. Please contact support.`)}function al(e){throw Error(`${...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.jsView on unpkg · L8788m(e){return this.#y.size>this.#D?void this.#y.clear():this.#y.get(e)}setItem(e,t){this.#y.set(e,t)}removeItem(e){this.#y.delete(e)}};let tp=new Set(["error","warn","info","debug","trace"]);var tf=class{#F;#L;#W={};#K=[];#H=null;constructor(e){this.#F={maxBufferSize:e.maxBufferSize??5,samplingRate:e.samplingRate??1,perEventSampling:e.perEventSampling??!0,disabled:e.disabled??!1,debug:e.debug??!1,endpoint:"https://clerk-telemetry.com"},!e.clerkVersion&&"u"<typeof window?this.#W.clerkVersion="":this.#W.clerkVersion=e.clerkVersion??"",this.#W.sdk=e.sdk,this.#W.sdkVersion=e.sdkVersion,this.#W.publi
Medium
Ai Review Evidence
The SDK telemetry code adds the first 16 characters of a configured secret key to its event payload.
dist/clerk.jsView on unpkg · L88Findings
1 High7 Medium4 Low
HighCopied Package Dependency Bridgedist/clerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/clerk.js
MediumAi Review Evidencedist/clerk.js
MediumAi Review Evidencedist/clerk.js
MediumAi Review Evidencedist/clerk.js
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @clerk/clerk-js@6.42.2.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @clerk/clerk-js@6.42.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.