@connect-xyz/auth-react@0.84.13
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 6h ago · by lpm-firewall-aiThe package performs undisclosed runtime reporting when the Auth widget fails to load, including page origin, browser details, and JWT-derived participant metadata sent to vendor collectors. This is suspicious telemetry; the report is limited to that failure path and does not include the raw JWT.
Decision evidence
public snapshot- When the Auth component’s script load fails, the package builds a diagnostic report containing JWT-derived participant and platform claims, browser user agent, and page origin.
- The package POSTs that report to default Grafana Faro collectors hosted by zerohash.com and zerohash.eu.
- The README documents the JWT-backed Auth component but does not disclose this failure-reporting telemetry.
- There are no lifecycle scripts; reporting occurs at runtime after the Auth component is rendered and its script load fails.
- The package does not POST the JWT itself; the report contains selected decoded claims and load diagnostics.
Source & flagged code
5 flaggedWhen the Auth component’s script load fails, the package builds a diagnostic report containing JWT-derived participant and platform claims, browser user agent, and page origin.
dist/index.jsView on unpkg · L137When the Auth component’s script load fails, the package builds a diagnostic report containing JWT-derived participant and platform claims, browser user agent, and page origin.
dist/index.jsView on unpkg · L165Findings
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.84.13.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.84.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.