registry / @connect-xyz/auth-js / 1.69.1
@connect-xyz/auth-js@1.69.1
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is a browser auth-widget loader with no automatic install or import-time execution. Its network behavior is activated by an explicit render call and is consistent with its SDK role; no concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
An application constructs Auth and calls Auth.render on a DOM element.
Impact
The configured auth widget runs in the host page; failure telemetry can include origin, user agent, and decoded JWT claim fields.
Mechanism
User-invoked remote widget loading with failure telemetry.
AI rationale
The package is a browser auth-widget loader with no automatic install or import-time execution. Its network behavior is activated by an explicit render call and is consistent with its SDK role; no concrete malicious behavior was found.
Network endpoints7
sdk.sandbox.connect.xyz/auth-web/index.jssdk.connect.xyz/auth-web/index.jsgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts or install-time executable entry.
- Calling Auth.render explicitly starts the widget loader, which loads fixed Connect-hosted modules.
- On a widget-load failure, the package posts diagnostic telemetry including browser and page metadata plus decoded JWT claims.
- The high-scanner path is a CRLF TypeScript declaration artifact describing the SDK, not an executable payload.
Evidence against
- No install hooks, subprocess execution, filesystem access, credential harvesting, obfuscation, or persistence were found.
- Remote loading is limited to fixed Connect SDK URLs and occurs only during an application's render call.
- Telemetry is restricted to load-failure reporting; the raw JWT is not placed in the constructed payload.
Behavioral surface
Network
MinifiedUrlStrings
Source & flagged code
7 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg1/**
* Connect Auth JavaScript SDK
*
* A programmatic JavaScript SDK for integrating the Connect Auth widget
* into web applications without requiring HTML custom elements.
*
* @packageDocumentation
*/
Low
Ai Review Evidence
The high-scanner path is a CRLF TypeScript declaration artifact describing the SDK, not an executable payload.
dist/index.d.tsView on unpkg · L1package.jsonView file
1{
"name": "@connect-xyz/auth-js",
"version": "1.69.1",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.umd.js",
"default": "./dist/index.js"
}
},
Findings
1 High1 Medium7 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.d.ts
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.69.1.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.69.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.