@clerk/clerk-js@6.29.3
Clerk JS library
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe manifest contains no install lifecycle scripts or executable bin, and reviewed bundled entrypoints show expected Clerk SDK behavior. Telemetry is explicit and directed to a Clerk-owned endpoint; no concrete malicious chain was found.
Decision evidence
public snapshot- Runtime code sends queued Clerk telemetry events and logs to a declared Clerk endpoint.
- package.json has no npm lifecycle hook and no bin entry.
- Entrypoints are bundled browser/React Native authentication SDK code.
- No child-process, filesystem-harvesting, AI-agent config, or remote-code-execution primitive was found in reviewed entrypoints.
Source & flagged code
3 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.native.jsView on unpkg · L29Runtime code sends queued Clerk telemetry events and logs to a declared Clerk endpoint.
dist/clerk.native.jsView on unpkg · L28Runtime code sends queued Clerk telemetry events and logs to a declared Clerk endpoint.
Findings
Affected versions and remediation
This report applies to @clerk/clerk-js@6.29.3.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.29.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.