registry / @connect-xyz/auth-js / 1.71.9
@connect-xyz/auth-js@1.71.9
A JavaScript SDK that enables frontend applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package exposes a browser authentication widget and performs fixed-destination diagnostics when its remote component fails to load. No install-time behavior, hidden credential transfer, or other concrete attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes render(), and loading the web component script fails.
Impact
This supports load-failure diagnostics; inspected source does not show credential forwarding or unrelated account actions.
Mechanism
The SDK posts a diagnostic payload containing selected JWT claims and browser or page metadata to an environment-specific collector.
AI rationale
The package exposes a browser authentication widget and performs fixed-destination diagnostics when its remote component fails to load. No install-time behavior, hidden credential transfer, or other concrete attack behavior was found.
Evidence
package.jsondist/index.d.tsdist/index.js
Network endpoints5
grafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines the module entrypoints and package contents and has no lifecycle script.
- The declaration describes Faro reporting for web component load failures and the partner or participant context.
- dist/index.js selects fixed Zerohash collector URLs for environment-specific diagnostics.
- The loader sends a JSON diagnostic request, and its payload contains selected JWT claims, browser user agent, and page origin.
- The reporting path is part of web component loading and receives the configured JWT.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggeddist/index.d.tsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.d.tsView on unpkg314The shared loader also reports failures to Faro (with JWT claims for
// partner/participant context) and removes a failed tag so a later
// render() call can retr
Low
Ai Review Evidence
The declaration describes Faro reporting for web component load failures and the partner or participant context.
dist/index.d.tsView on unpkg · L314package.jsonView file
1{
"name": "@connect-xyz/auth-js",
"version": "1.71.9",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.umd.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "auth-js",
"targets": {
"build-static": {}
}
}
}
Findings
1 High1 Medium8 Low
HighSemantic Analysis Limiteddist/index.d.ts
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.d.ts
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/auth-js@1.71.9.
See all versions of @connect-xyz/auth-js for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-js@1.71.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.