registry / @connect-xyz/auth-react / 0.84.4
@connect-xyz/auth-react@0.84.4
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe manifest identifies a React authentication widget, and the inspected entrypoint loads its vendor SDK when rendered. Its load-failure telemetry is sent to configured collectors with browser and page metadata; no malicious behavior was established.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders the exported Auth component.
Impact
The inspected behavior supports the authentication widget and its failure reporting; no confirmed attack surface was established.
Mechanism
The component adds a vendor script to the page and may POST failure telemetry containing browser and page metadata.
AI rationale
The manifest identifies a React authentication widget, and the inspected entrypoint loads its vendor SDK when rendered. Its load-failure telemetry is sent to configured collectors with browser and page metadata; no malicious behavior was established.
Evidence
dist/index.js
Network endpoints7
sdk.connect.xyzsdk.sandbox.connect.xyzgrafana-faro-collector.dev.0hash.comgrafana-faro-collector.cert.zerohash.comgrafana-faro-collector.zerohash.comgrafana-faro-collector.cert.zerohash.eugrafana-faro-collector.zerohash.eu
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/index.js as the package entrypoint.
- The exported Auth component loads the vendor authentication widget when rendered.
- The package posts component-load failure telemetry to configured Zerohash collectors; the payload contains browser and page metadata.
- The default widget script URLs point to Connect's sandbox and production SDK hosts.
Evidence against
- The inspected source showed no lifecycle scripts or install-time behavior.
- Telemetry is tied to widget load failures and uses the package's configured collector destinations.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
5"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.
Low
Ai Review Evidence
package.json exposes dist/index.js as the package entrypoint.
package.jsonView on unpkg · L5dist/index.jsView file
227ent: c,
onLoaded: a,
...s
}) => {
const u = M(null);
D(u, { theme: o, onError: n, onClose: r, onDeposit: i, onEvent: c, onLoaded: a });
const { loadFailed: b, retry: m } = Q({
webComponentTag: B,
scriptUrls: Y,
env: t,
jwt: e
});
return b ? /* @__PURE__ */ d(
V,
{
onRetry: m,
onClose: r
Low
Ai Review Evidence
The exported Auth component loads the vendor authentication widget when rendered.
dist/index.jsView on unpkg · L227108ributes: r },
browser: typeof navigator < "u" ? { userAgent: navigator.userAgent } : void 0,
page: typeof window < "u" ? { url: window.location.origin } : void 0
Findings
1 Medium7 Low
MediumNetwork
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.84.4.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.84.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.