@connect-xyz/auth-react@0.84.10
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install-time behavior, and its hosted-widget loader fits its stated purpose. However, failed loads automatically send selected JWT claims and browser context to a collector without disclosure or an opt-out in the inspected files, which is suspicious runtime telemetry.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders Auth and the hosted widget fails to load or define its custom element, or times out.
Impact
The collector receives contextual browser and account or project metadata without a documented opt-out in the inspected package files.
Mechanism
The package posts a JSON error report containing selected decoded JWT claims, browser user agent, page origin, and load details to a Grafana collector.
AI rationale
The package has no install-time behavior, and its hosted-widget loader fits its stated purpose. However, failed loads automatically send selected JWT claims and browser context to a collector without disclosure or an opt-out in the inspected files, which is suspicious runtime telemetry.
Evidence
dist/index.js
Network endpoints6
grafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collectsdk.connect.xyz/auth-web/index.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no lifecycle scripts; the package exports a React entry point.
- Rendering Auth passes its JWT to a loader for Connect’s hosted widget.
- On a load failure, the report includes selected JWT claims, browser user agent, and page origin.
- The failure report is sent as a JSON POST to the configured Grafana collector.
- Reporting is triggered automatically by widget load errors or timeouts.
Evidence against
- The package’s stated purpose is a React wrapper for Connect Auth, and loading the hosted widget fits that purpose.
- The report is limited to widget-load failure context; the inspected code does not send the full JWT.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
1{
"name": "@connect-xyz/auth-react",
"version": "0.84.10",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "auth-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Medium
Suspicious Lifecycle Evidence
The manifest has no lifecycle scripts; the package exports a React entry point.
package.jsonView on unpkg · L1dist/index.jsView file
296,
production: "https://sdk.connect.xyz/auth-web/index.js"
}, w = "connect-auth", T = C, E = ({ jwt: t, env: r = "production", theme: i, onError: o, onClose: s, onDeposit: u, onEvent: d, onLoaded: f, ...p }) => {
let m = a(null);
l(m, {
theme: i,
onError: o,
onClose: s,
onDeposit: u,
onEvent: d,
onLoaded: f
});
let { loadFailed: h, retry: g } = S({
webComponentTag: w,
scriptUrls: T,
env: r,
jwt: t
});
return h ? /* @__PU
Medium
Ai Review Evidence
Rendering Auth passes its JWT to a loader for Connect’s hosted widget.
Findings
7 Medium1 Low
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowUrl Strings
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.84.10.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.84.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.