registry / @connect-xyz/auth-react / 0.84.8
@connect-xyz/auth-react@0.84.8
A React SDK that enables frontend React applications to seamlessly integrate with the Connect Auth product.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe entrypoint implements a React wrapper for the hosted Connect Auth widget and has no install lifecycle behavior. Its only observed outbound report is failure-triggered diagnostic telemetry containing selected claims and browser context, not the raw JWT; no concrete attack surface was established.
Static reason
No blocking static signals were detected.
Trigger
Rendering Auth in a browser starts the widget load; a load error, timeout, or missing custom element triggers diagnostic reporting.
Impact
The source shows no raw JWT transfer or other confirmed attack behavior; the observed metadata transfer is limited to widget-load failures.
Mechanism
The failure report contains app and error context, selected JWT claims, user agent, and page origin, then posts JSON to an environment-specific Grafana Faro collector.
AI rationale
The entrypoint implements a React wrapper for the hosted Connect Auth widget and has no install lifecycle behavior. Its only observed outbound report is failure-triggered diagnostic telemetry containing selected claims and browser context, not the raw JWT; no concrete attack surface was established.
Evidence
package.jsondist/index.js
Network endpoints7
sdk.sandbox.connect.xyz/auth-web/index.jssdk.connect.xyz/auth-web/index.jsgrafana-faro-collector.dev.0hash.com/collectgrafana-faro-collector.cert.zerohash.com/collectgrafana-faro-collector.zerohash.com/collectgrafana-faro-collector.cert.zerohash.eu/collectgrafana-faro-collector.zerohash.eu/collect
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports dist/index.js as the runtime entrypoint and declares no lifecycle scripts or runtime dependencies.
- The Auth component loads the Connect Auth SDK from its sandbox or production host and passes the caller-provided JWT to the widget.
- Load error, timeout, or missing-widget events trigger a report; the report includes app and failure details, selected JWT claims, browser user agent, and page origin.
- The report sends JSON to fixed Grafana Faro collector endpoints; no raw JWT is included in the constructed payload.
Evidence against
- The failure report automatically sends selected JWT claims and browser/page metadata to the configured environment collector when the remote widget fails to load.
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
1{
"name": "@connect-xyz/auth-react",
"version": "0.84.8",
"private": false,
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"license": "MIT",
"exports": {
"./package.json": "./package.json",
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"default": "./dist/index.js"
}
},
"files": [
"dist",
"!**/*.tsbuildinfo"
],
"nx": {
"name": "auth-react"
},
"peerDependencies": {
"react": ">=18.0.0",
"react-dom": ">=18.0.0"
}
}
Low
Suspicious Lifecycle Evidence
package.json exports dist/index.js as the runtime entrypoint and declares no lifecycle scripts or runtime dependencies.
package.jsonView on unpkg · L1dist/index.jsView file
296sandbox: "https://sdk.sandbox.connect.xyz/auth-web/index.js",
production: "https://sdk.connect.xyz/auth-web/index.js"
}, w =
Low
Ai Review Evidence
The Auth component loads the Connect Auth SDK from its sandbox or production host and passes the caller-provided JWT to the widget.
dist/index.jsView on unpkg · L296Findings
1 Medium9 Low
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @connect-xyz/auth-react@0.84.8.
See all versions of @connect-xyz/auth-react for other recorded verdicts.
- Review the evidence and your use of @connect-xyz/auth-react@0.84.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.