@connect-xyz/auth-js@1.71.10
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe SDK automatically reports widget load failures to hard-coded Faro collectors with JWT-derived participant/platform claims and browser context, and its public API provides no way to disable the reports. This is runtime telemetry beyond minimal package and platform signals, so it warrants a warning; the source documents the reporting and does not show the JWT itself being sent.
Decision evidence
public snapshot- The SDK hard-codes Faro collector URLs under 0hash.com and zerohash.com/.eu.
- It decodes participant and platform claims from the supplied JWT for the report payload.
- The report payload includes the page origin and browser user agent.
- The loader POSTs the event to its collector when the widget script fails to load.
- The type file documents failure reporting to Faro with partner/participant JWT claims.
- The package entry points export the Auth widget SDK, and the package has no lifecycle scripts.
- The report path is reached during widget script loading, which is initiated by the SDK’s explicit render flow.
- The source comment documents failure reporting; the evidence does not show the JWT itself being sent in the report.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkgThe type file documents failure reporting to Faro with partner/participant JWT claims.
dist/index.d.tsView on unpkg · L314Findings
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.71.10.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.71.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.