@connect-xyz/auth-react@0.84.6
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the shipped wrapper's network behavior is browser-side Auth component loading and error telemetry to the package's service endpoints. The inspected source provides no evidence of credential exfiltration or other attack behavior.
Decision evidence
public snapshot- The manifest points to the shipped React entrypoint and declares React as a peer dependency; it contains no lifecycle scripts.
- The wrapper loads the Connect Auth component from the sandbox or production Connect SDK host when used in a browser.
- On a failed script load, the wrapper builds diagnostic telemetry and posts it to environment-specific Zerohash collectors.
- The diagnostic payload includes browser and page-origin metadata and selected claims parsed from the caller-provided JWT.
Source & flagged code
8 flaggedThe manifest points to the shipped React entrypoint and declares React as a peer dependency; it contains no lifecycle scripts.
package.jsonView on unpkg · L1The wrapper loads the Connect Auth component from the sandbox or production Connect SDK host when used in a browser.
dist/index.jsFindings
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.84.6.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.84.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.