registry / @clerk/clerk-js / 6.27.1
@clerk/clerk-js@6.27.1
Clerk JS library
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoNetwork
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
1 flaggeddist/clerk.native.jsView file
17package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @zxcvbn-ts/core
L17: For more information contact us at ${t}`)}function ii(e){throw Error(`${t4} Calling ${e}.reload is not currently supported. Please contact support.`)}function ir(e){throw Error(`${...
L18: API Error: ${n}`,{data:t,status:e})}}(s,e);let r={data:e,status:s};if(429===s&&o){let e=o.get("retry-after");if(e){let t=parseInt(e,10);isNaN(t)||(r.retryAfter=t)}}throw new F(t||a...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.native.jsView on unpkg · L17Findings
1 High3 Medium3 Low
HighCopied Package Dependency Bridgedist/clerk.native.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @clerk/clerk-js@6.27.1.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.27.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.