@connect-xyz/auth-js@1.69.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found a browser Auth-widget SDK with no lifecycle hooks or host-side execution. Its remote script loading and failure telemetry are confined to the explicit render path and are consistent with its package role.
Decision evidence
public snapshot- The manifest declares package entrypoints and contains no lifecycle scripts.
- The declaration file is type documentation for the Auth widget, not executable runtime code.
- Runtime loading is initiated by the Auth render flow and targets fixed Connect SDK URLs.
- The runtime posts script-load failure telemetry containing JWT-derived claims, browser user agent, and page origin.
- The widget loader injects a remote module script after the application calls render.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declaration file is type documentation for the Auth widget, not executable runtime code.
dist/index.d.tsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.69.0.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.69.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.