@connect-xyz/auth-js@1.71.11
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package performs error-triggered runtime telemetry to its vendor collector, including page origin and JWT-derived partner context. Although the declaration mentions Faro reporting, the inspected API exposes no way to turn it off, so this is suspicious telemetry rather than a clean result.
Static reason
No blocking static signals were detected.
Trigger
A consumer explicitly renders the widget and its script load fails or times out.
Impact
The collector receives identifying page context and partner/participant claims; no opt-out is exposed in the Auth API inspected.
Mechanism
The loader posts a Faro report containing the page origin, widget context, failure details, and selected claims decoded from the supplied JWT.
AI rationale
The package performs error-triggered runtime telemetry to its vendor collector, including page origin and JWT-derived partner context. Although the declaration mentions Faro reporting, the inspected API exposes no way to turn it off, so this is suspicious telemetry rather than a clean result.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints5
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On widget load failure, the SDK builds an error report containing the page origin, widget and environment, script URL, failure reason, and timing.
- The SDK POSTs reports to hard-coded Grafana Faro collectors, including the production zerohash.com collector.
- The Auth loader passes its JWT to the shared loader, which decodes and includes JWT claims in failure reports; the declaration documents reporting partner/participant context to Faro.
- The report is sent during the explicit widget loading flow, and the package declares no lifecycle scripts.
Evidence against
- The report is limited to script-loading failures rather than sent automatically at package import or installation.
- The declaration comments disclose Faro failure reporting, and the package’s purpose is to load the Connect Auth widget.
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg314es to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() call can retry cleanly.
this.scriptLoadingPromise = new Promise<void>((resolve, reject) => {
loadWebComponentScript({
webComponentTag: this.webComponentTag,
appName: this.webComponentTag,
Medium
Ai Review Evidence
The Auth loader passes its JWT to the shared loader, which decodes and includes JWT claims in failure reports; the declaration documents reporting partner/participant context to Faro.
dist/index.d.tsView on unpkg · L314dist/index.jsView file
1var e = {
dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collector.zerohash.com/collect",
"eu-cert": "https://grafana-faro-collector.cert.zerohash.eu/collect",
"eu-prod": "https://grafana-faro-collector.zerohash.eu/collect",
sandbox: "https://grafana-faro-collector.cert.zerohash.com/collect",
production: "https://grafana-faro-collector.zerohash.com/collect"
}, t = (e) => {
if (!e || typeof e != "string") return null;
let t = e.sp
Findings
1 High7 Medium1 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.d.ts
MediumSuspicious Lifecycle Evidencepackage.json
LowUrl Strings
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.71.11.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.71.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.