registry / @connect-xyz/auth-react / 0.84.1
@connect-xyz/auth-react@0.84.1
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe source shows package-aligned authentication-component loading and diagnostic telemetry on load failure, with no install hook or concrete malicious behavior identified. The telemetry includes JWT-derived claims but the inspected send path does not include the JWT itself.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the Auth component and the external script fails to load or define its web component.
Impact
The collector receives app, environment, browser, page-origin, script, and JWT-claim metadata; the inspected code does not transmit the JWT itself.
Mechanism
The package injects the configured script URL and reports failure metadata with a POST request to the selected collector.
AI rationale
The source shows package-aligned authentication-component loading and diagnostic telemetry on load failure, with no install hook or concrete malicious behavior identified. The telemetry includes JWT-derived claims but the inspected send path does not include the JWT itself.
Evidence
package.jsondist/index.js
Network endpoints5
sdk.sandbox.connect.xyz/auth-web/index.jssdk.connect.xyz/auth-web/index.jsgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collect
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the package entrypoint and declares no lifecycle scripts.
- The React component loads the Connect Auth web component from Connect SDK endpoints when rendered.
- On a load failure, the component sends diagnostic metadata to a configured collector or a default Zerohash Grafana Faro collector.
- The telemetry payload includes app and environment details, browser user agent, page origin, component script URL, failure reason, and JWT-derived claims; inspected code does not send the JWT itself.
Evidence against
- The inspected network behavior is tied to loading the package’s authentication component and reporting its load failures.
- No install-time execution, credential harvesting, or unrelated destination was identified in the inspected source.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
6"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
Low
Suspicious Lifecycle Evidence
package.json exposes dist/index.js as the package entrypoint and declares no lifecycle scripts.
package.jsonView on unpkg · L6dist/index.jsView file
218sandbox: "https://sdk.sandbox.connect.xyz/auth-web/index.js",
production: "https://sdk.connect.xyz/auth-web/index.js"
}, B = "connect-auth", Y = X, oe = ({
jwt: e,
env: t = "
Low
Ai Review Evidence
The React component loads the Connect Auth web component from Connect SDK endpoints when rendered.
dist/index.jsView on unpkg · L21853dev: "https://grafana-faro-collector.dev.0hash.com/collect",
cert: "https://grafana-faro-collector.cert.zerohash.com/collect",
prod: "https://grafana-faro-collector.zerohash.co
Findings
1 Medium6 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.84.1.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.84.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.