@connect-xyz/auth-js@1.70.0
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package exposes a widget SDK without install-time hooks, and its inspected network behavior loads Connect widget scripts and reports script-load failures to its configured telemetry collector. The telemetry includes selected JWT claims, but the source shows no unrestricted destination or concrete attack behavior.
Decision evidence
public snapshot- package.json exposes the SDK entrypoints and declares no lifecycle hooks.
- dist/index.d.ts identifies the widget script URLs as Connect SDK endpoints.
- dist/index.js posts error-report payloads through fetch when a script-load failure is reported.
- The reported payload contains selected JWT claims and script-load diagnostics; the reporter is called from the script-load failure path.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgdist/index.d.ts identifies the widget script URLs as Connect SDK endpoints.
dist/index.d.tsView on unpkg · L56Findings
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.70.0.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.70.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.