@connect-xyz/auth-js@1.69.2
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection shows a browser authentication SDK with user-invoked remote widget loading and failure telemetry, but no install hook, persistence, credential harvesting, or unconsented execution path. The observed network behavior is package-aligned and uses fixed endpoints.
Decision evidence
public snapshot- Rendering dynamically loads the Connect Auth web component from fixed vendor URLs.
- On widget-load failure, the package posts diagnostics and selected decoded JWT claims to fixed Faro collector endpoints.
- The manifest exposes library entry points and contains no lifecycle scripts or dependency sections.
- The declaration file identifies this as a Connect Auth widget integration SDK.
- No install-time hook, shell execution, filesystem access, environment harvesting, or self-dependency is present.
- Network activity is reached through the caller's render flow, not during installation or module import.
- The remote script URLs and telemetry endpoints are fixed and aligned with the package's authentication-widget function.
Source & flagged code
5 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe declaration file identifies this as a Connect Auth widget integration SDK.
dist/index.d.tsView on unpkg · L2Findings
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.69.2.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.69.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.