registry / @connect-xyz/auth-js / 1.71.7
@connect-xyz/auth-js@1.71.7
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe inspected entrypoints and runtime code implement a browser authentication widget, with failure-only diagnostic reporting to environment-specific collectors. No concrete malicious behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls render(), and loading the widget script fails.
Impact
The report discloses diagnostic and contextual metadata to the package’s configured collectors; the inspected code does not send the JWT itself or establish an attack.
Mechanism
The bundle posts a failure report containing JWT-derived partner or participant claims, browser metadata, and error context to an environment-specific Faro collector.
AI rationale
The inspected entrypoints and runtime code implement a browser authentication widget, with failure-only diagnostic reporting to environment-specific collectors. No concrete malicious behavior was found.
Evidence
package.jsondist/index.d.tsdist/index.js
Network endpoints7
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eusdk.sandbox.connect.xyzsdk.connect.xyz
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes browser SDK bundles and declares no lifecycle scripts.
- dist/index.d.ts describes a JWT-authenticated widget whose loader reports script-load failures to Faro with partner or participant context.
- dist/index.js sends telemetry only through the failure-report path; its payload contains JWT-derived claims and browser metadata, not the JWT itself.
- dist/index.js selects environment-specific Faro collectors and loads the Auth widget when render() is called.
- The inspected bundle contains no credential harvesting, shell execution, dynamic code execution, persistence, or consumer configuration mutation.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
9 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg112declare interface BaseConfig<TEvent = AppEvent> extends CommonCallbacks<TEvent> {
/**
* JWT token used for authentication. Provide/update it via `setJWT`
* (`updateConfig({ jwt })`).
*/
jwt: string;
/
Low
Ai Review Evidence
dist/index.d.ts describes a JWT-authenticated widget whose loader reports script-load failures to Faro with partner or participant context.
dist/index.d.tsView on unpkg · L112314// The shared loader also reports failures to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() call can retry cleanly.
this.scriptLoadingPromise = new Promise<void>((resolve, reject) => {
loadWebComponentScript({
webComponentTag: this.webComponentT
Low
Ai Review Evidence
Findings
1 High1 Medium9 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.71.7.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.71.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.