registry / @clerk/clerk-js / 6.31.0
@clerk/clerk-js@6.31.0
Clerk JS library
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner signals are consistent with a bundled authentication library and included wallet SDKs. Direct inspection found no lifecycle execution, self-dependency chain, persistence, harvesting, or destructive behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
An application imports and initializes the Clerk browser or React Native library.
Impact
The library can make configured authentication and wallet service requests during normal use.
Mechanism
Authentication and wallet API runtime communication.
AI rationale
The scanner signals are consistent with a bundled authentication library and included wallet SDKs. Direct inspection found no lifecycle execution, self-dependency chain, persistence, harvesting, or destructive behavior.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no preinstall, install, or postinstall lifecycle hook.
- The package does not depend on its own package name.
- The declared entrypoints are bundled JavaScript library files for browser and React Native use.
- Inspection found no child-process execution, evaluator, filesystem harvesting, or install-time project mutation.
- The bundle configures an optional telemetry collector as a logging transport.
Evidence against
- The bundled runtime contains network and telemetry-related functionality.
- The bundle includes third-party wallet SDK code and environment checks, which explain the scanner signals but add normal authentication runtime complexity.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggeddist/clerk.native.jsView file
15${e.trim()}
L16: (This notice only appears in development)`,e8=e=>e6(`${e} as a function is not supported in this environment. The value will be ignored. Provide an absolute URL instead.`),e9={prox...
L17: For more information contact us at ${t}`)}function is(e){throw Error(`${t6} Calling ${e}.reload is not currently supported. Please contact support.`)}function ia(e){throw Error(`${...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/clerk.native.jsView on unpkg · L15dist/clerk.jsView file
59package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @base-org/account
L59: ${e.trim()}
L60: (This notice only appears in development)`,e6=e=>e5(`${e} as a function is not supported in this environment. The value will be ignored. Provide an absolute URL instead.`),e8={prox...
L61: For more information contact us at ${t}`)}function ar(e){throw Error(`${t5} Calling ${e}.reload is not currently supported. Please contact support.`)}function an(e){throw Error(`${...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.jsView on unpkg · L59Findings
1 High4 Medium5 Low
HighCopied Package Dependency Bridgedist/clerk.js
MediumDynamic Requiredist/clerk.native.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/clerk.js
Affected versions and remediation
This report applies to @clerk/clerk-js@6.31.0.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.31.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.