registry / @clerk/clerk-js / 6.30.1
@clerk/clerk-js@6.30.1
Clerk JS library
AI Security Review
scanned 27d ago · by lpm-firewall-aiInspected source shows ordinary Clerk package metadata and vendor telemetry gated to development instances with a disable option. The static flags do not establish a malicious attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
The package is imported and initialized in a development instance, then telemetry is recorded.
Impact
Development telemetry is transmitted to the package vendor; no malicious behavior was established.
Mechanism
Recorded events and logs are POSTed to the configured Clerk telemetry endpoint; production instances and disabled telemetry skip this path.
AI rationale
Inspected source shows ordinary Clerk package metadata and vendor telemetry gated to development instances with a disable option. The static flags do not establish a malicious attack surface.
Network endpoints1
clerk-telemetry.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies the Clerk JavaScript repository and the clerk-js package directory.
- The manifest contains build and development scripts but no preinstall, install, or postinstall hook.
- The bundled telemetry endpoint is Clerk-owned and telemetry is restricted to development instances, with a disable option.
- Telemetry events and logs are sent by POST to the configured telemetry endpoint.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/clerk.jsView file
59package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @base-org/account
L59: ${e.trim()}
L60: (This notice only appears in development)`,e6=e=>e5(`${e} as a function is not supported in this environment. The value will be ignored. Provide an absolute URL instead.`),e8={prox...
L61: For more information contact us at ${t}`)}function ar(e){throw Error(`${t5} Calling ${e}.reload is not currently supported. Please contact support.`)}function an(e){throw Error(`${...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.jsView on unpkg · L5960:e.debug??!1,endpoint:"https://clerk-telemetry.com"},!e.clerkVersion&&"u"<typeof window?this.#K.clerkVersion="":this.#K.clerkVersion=e.clerkVersion??"",this.#K.sdk=e.sdk,this.#K.sdkVersion=e.sdkVersion,this.#K.
Low
Ai Review Evidence
The bundled telemetry endpoint is Clerk-owned and telemetry is restricted to development instances, with a disable option.
dist/clerk.jsView on unpkg · L6060==this.#K.instanceType||this.#L.disabled||"u">typeof process&&process.env&&eb(process.env.CLERK_TELEMETRY_DISABLED)||"u">typeof window&&window?.navigator?.webdriver)}get isDebug(){return this.#L.debug||"u">typeof process
Findings
1 High3 Medium8 Low
HighCopied Package Dependency Bridgedist/clerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/clerk.js
LowAi Review Evidencedist/clerk.js
Affected versions and remediation
This report applies to @clerk/clerk-js@6.30.1.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.30.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.