registry / @clerk/clerk-js / 6.42.1
@clerk/clerk-js@6.42.1
Clerk JS library
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package metadata and runtime behavior match Clerk’s authentication SDK. Its telemetry is disclosed, limited to development instances, and has a runtime disable control; the scanner’s network and dependency-bridge indicators are consistent with the SDK’s bundled integrations.
Static reason
One or more suspicious static signals were detected.
Trigger
Normal SDK use; telemetry is gated to development instances, and wallet or CAPTCHA requests occur when those features are used.
Impact
No malicious impact identified from the inspected source.
Mechanism
The SDK sends buffered telemetry to clerk-telemetry.com and includes integrations that use external wallet and CAPTCHA services.
AI rationale
The package metadata and runtime behavior match Clerk’s authentication SDK. Its telemetry is disclosed, limited to development instances, and has a runtime disable control; the scanner’s network and dependency-bridge indicators are consistent with the SDK’s bundled integrations.
Network endpoints4
clerk-telemetry.comrpc.wallet.coinbase.comkeys.coinbase.comchallenges.cloudflare.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package metadata identifies the expected Clerk JavaScript library and points to Clerk’s official repository.
- The SDK explicitly tells users that telemetry is collected when connected to development instances and links to opt-out information.
- Runtime telemetry is disabled outside development instances and can be disabled with a configuration flag or CLERK_TELEMETRY_DISABLED; buffered events and logs are sent to the declared Clerk telemetry endpoint.
Evidence against
- The SDK contains network calls, including telemetry POSTs to clerk-telemetry.com.
- The telemetry collector can receive event payloads and log context, so its runtime behavior merits review.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/clerk.jsView file
87package = @clerk/clerk-js; repositoryIdentity = javascript; dependency = @base-org/account
L87: ${e.trim()}
L88: (This notice only appears in development)`,e7=e=>e4(`${e} as a function is not supported in this environment. The value will be ignored. Provide an absolute URL instead.`),te={prox...
L89: For more information contact us at ${t}`)}function as(e){throw Error(`${t4} Calling ${e}.reload is not currently supported. Please contact support.`)}function ao(e){throw Error(`${...
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/clerk.jsView on unpkg · L8788Attention: Clerk collects telemetry data from its SDKs when connected to development instances.","The data collected is used to inform Clerk's product roadmap.","To learn more, inc
Low
Ai Review Evidence
The SDK explicitly tells users that telemetry is collected when connected to development instances and links to opt-out information.
dist/clerk.jsView on unpkg · L8888s[tl]=!0}catch{}}({skip:!this.isEnabled})}get isEnabled(){return!("development"!==this.#W.instanceType||this.#F.disabled||"u">typeof process&&process.env&&ev(process.env.CLERK_TELEMETRY_DISABLED)||"u">typeof window&&window?.navigator?.webdriver)}get isDebug(){return this.#F.debug||"u">typeof process&&process.env&&ev(process.env.
Findings
1 High3 Medium8 Low
HighCopied Package Dependency Bridgedist/clerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/clerk.js
LowAi Review Evidencedist/clerk.js
LowAi Review Evidencedist/clerk.js
Affected versions and remediation
This report applies to @clerk/clerk-js@6.42.1.
See all versions of @clerk/clerk-js for other recorded verdicts.
- Review the evidence and your use of @clerk/clerk-js@6.42.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.