@connect-xyz/auth-react@0.82.3
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package is a React wrapper that loads its vendor web component and reports load failures to fixed vendor telemetry collectors. Inspected behavior is package-aligned diagnostics, with no concrete attack surface established.
Decision evidence
public snapshot- package.json points the package entrypoint to dist/index.js; no install lifecycle scripts are declared.
- On load failures, the runtime posts telemetry to fixed Zerohash collector endpoints.
- Telemetry contains app/session attributes, browser user agent, page origin, and component load failure details.
- The component script uses fixed Connect SDK hosts; no credential forwarding or unrelated recipient was found.
Source & flagged code
5 flaggedpackage.json points the package entrypoint to dist/index.js; no install lifecycle scripts are declared.
package.jsonView on unpkg · L6On load failures, the runtime posts telemetry to fixed Zerohash collector endpoints.
dist/index.jsView on unpkg · L56Findings
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.82.3.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.82.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.