registry / @clerk/clerk-js / 6.40.1
@clerk/clerk-js@6.40.1
Clerk JS library
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest’s runtime bundles contain a Coinbase wallet bridge, and the inspected dependency source identifies it as wallet SDK functionality. The scanner’s copied-bridge signal does not establish malicious behavior; no concrete attack surface was found in the inspected source.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer requests a wallet provider through Clerk’s runtime API.
Impact
The inspected behavior supports wallet access and does not establish credential theft, unrequested account changes, or other attack behavior.
Mechanism
The bundle conditionally imports the Base Account SDK and requests a provider; the bridge uses Coinbase’s wallet RPC endpoint.
AI rationale
The manifest’s runtime bundles contain a Coinbase wallet bridge, and the inspected dependency source identifies it as wallet SDK functionality. The scanner’s copied-bridge signal does not establish malicious behavior; no concrete attack surface was found in the inspected source.
Evidence
dist/clerk.jsdist/clerk.mjsdist/clerk.no-rhc.jsdist/clerk.no-rhc.mjsdist/clerk.legacy.browser.js.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/0/npm-linux/package.json.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/0/npm-linux/dist/index.js.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/0/npm-linux/dist/base-account.js.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/0/npm-linux/dist/base-account.min.js.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/1/npm-linux/package.json.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/1/npm-linux/dist/index.js.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/2/npm-linux/package.json.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/2/npm-linux/lib/index.js.lpm-dependency-evidence-c47e5636-c683-43b4-b2b7-4e64a9fae961/2/npm-linux/lib/index.mjs
Network endpoints1
rpc.wallet.coinbase.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest selects Clerk JavaScript runtime bundles and declares no install lifecycle hook.
- The Coinbase RPC and account APIs belong to a bundled Base Account wallet SDK bridge, exposed when the wallet provider is requested.
- The inspected Base Account, Coinbase Wallet, and Stripe files match their declared package identities and show no install hooks.
- The inspected runtime and dependency excerpts support expected authentication and wallet functionality; no concrete attack behavior was identified.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/clerk.jsView file
87package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @base-org/account
L87: ${e.trim()}
L88: (This notice only appears in development)`,te=e=>e7(`${e} as a function is not supported in this environment. The value will be ignored. Provide an absolute URL instead.`),tt={prox...
L89: For more information contact us at ${t}`)}function al(e){throw Error(`${ae} Calling ${e}.reload is not currently supported. Please contact support.`)}function ac(e){throw Error(`${...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.jsView on unpkg · L872@base-org/account","rE":"2.0.1"}');let u="https://rpc.wallet.coinbase.com",d=c.UU,h=c.rE;function m(e,t){let a;try{a=e()}catch(e){return}return{getItem:e=>{var r;let n=e=>null===e?
Low
Ai Review Evidence
The Coinbase RPC and account APIs belong to a bundled Base Account wallet SDK bridge, exposed when the wallet provider is requested.
dist/clerk.jsView on unpkg · L2package.jsonView file
Findings
1 High3 Medium8 Low
HighCopied Package Dependency Bridgedist/clerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/clerk.js
LowAi Review Evidencedist/clerk.mjs
Affected versions and remediation
This report applies to @clerk/clerk-js@6.40.1.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.40.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.