registry / @edge-base/web / 0.3.3

@edge-base/web@0.3.3

EdgeBase web SDK — browser client with database-live subscriptions, room, and auth persistence

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a browser EdgeBase SDK with auth, realtime, room, captcha, push, and analytics methods activated by application code.

Static reason

One or more suspicious static signals were detected.

Trigger

Application imports the SDK and calls exported client/auth/live/room/analytics methods

Impact

Expected SDK traffic to configured EdgeBase endpoints and Cloudflare Turnstile; no install-time mutation, persistence, or exfiltration found

Mechanism

Runtime browser SDK network client

Rationale

Static inspection shows a normal browser SDK with no lifecycle hooks or import-time execution beyond exports; the network and storage primitives are package-aligned and user-invoked. No credential harvesting beyond intended auth token management, destructive behavior, persistence, or AI-agent control-surface mutation was found.

Evidence

package.jsondist/index.jsdist/client.jsdist/auth.jsdist/auth-refresh.jsdist/token-manager.jsdist/database-live.jsdist/room.jsdist/turnstile.jsdist/analytics.jsdist/browser-storage.jsllms.txt

Network endpoints4

challenges.cloudflare.com/turnstile/v0/api.jsgithub.com/edge-base/edgebase.gitgithub.com/edge-base/edgebase/tree/main/packages/sdk/js/packages/webgithub.com/edge-base/edgebase/issues

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/auth-refresh.js posts refresh tokens to caller-provided baseUrl /api/auth/refresh
dist/turnstile.js dynamically loads Cloudflare Turnstile script for captcha
dist/database-live.js and dist/room.js open WebSockets to caller-provided baseUrl

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks
dist/index.js only re-exports SDK modules; no import-time network or mutation observed
No child_process, fs, eval/vm/Function, native/binary loading, or shell execution found by source search
Token storage in dist/token-manager.js is browser localStorage/memory for SDK auth state
llms.txt is documentation/examples, not executable code or a secret-bearing payload
Network behavior is user-invoked SDK functionality against configured EdgeBase services

Behavioral surface

Source

NetworkWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 171 KB of source, external domains: challenges.cloudflare.com

Source & flagged code

4 flagged

llms.txtView file

Lines 43-83text

43npm create edgebase@latest edgebase

44```

46This is a recommendation, not a requirement. Separate repos or a different subdirectory name are also valid.

48## Canonical Examples

50### Create a client

52```ts

53import { createClient } from '@edge-base/web';

55const client = createClient('https://your-project.edgebase.fun');

56```

58### Sign in and react to auth changes

60```ts

61await client.auth.signIn({

62 email: 'june@example.com',

63 password: 'pass1234',

Medium

Secret Pattern

Package contains a possible secret pattern.

llms.txtView on unpkg · L63

64});

66const user = client.auth.currentUser;

68const unsubscribeAuth = client.auth.onAuthStateChange((nextUser) => {

69 console.log('auth changed:', nextUser);

70});

71```

73### Query data from a single-instance block

75```ts

76type Post = {

77 id: string;

78 title: string;

79 published: boolean;

80};

82const posts = await client

83 .db('app')

README.mdView file

Lines 145-185markdown

145

146This is only a recommendation, not a requirement.

147

148You can also:

149

150- create EdgeBase as a completely separate project

151- keep frontend and backend in different repos

152- use a different subdirectory name if that fits your monorepo better

153

154The main thing we recommend is avoiding scaffolding directly into an existing app root unless that is intentionally how you want to organize the repo.

155

156## Quick Start

157

Source & flagged code

4 flagged · loading source

llms.txtView file

63patternName = generic_password severity = medium line = 63 matchedText = password...34',

Medium

Secret Pattern

Package contains a possible secret pattern.

llms.txtView on unpkg · L63

README.mdView file

165patternName = generic_password severity = medium line = 165 matchedText = password...34',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L165

218patternName = generic_password severity = medium line = 218 matchedText = password...34',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L218

226patternName = generic_password severity = medium line = 226 matchedText = password...34',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L226

Findings

5 Medium4 Low

MediumSecret Patternllms.txt

MediumNetwork

MediumSecret PatternREADME.md

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

llms.txtView file

Lines 43-83text

43npm create edgebase@latest edgebase

44```

46This is a recommendation, not a requirement. Separate repos or a different subdirectory name are also valid.

48## Canonical Examples

50### Create a client

52```ts

53import { createClient } from '@edge-base/web';

55const client = createClient('https://your-project.edgebase.fun');

56```

58### Sign in and react to auth changes

60```ts

61await client.auth.signIn({

62 email: 'june@example.com',

63 password: 'pass1234',

Medium

Secret Pattern

Package contains a possible secret pattern.

llms.txtView on unpkg · L63

64});

66const user = client.auth.currentUser;

68const unsubscribeAuth = client.auth.onAuthStateChange((nextUser) => {

69 console.log('auth changed:', nextUser);

70});

71```

73### Query data from a single-instance block

75```ts

76type Post = {

77 id: string;

78 title: string;

79 published: boolean;

80};

82const posts = await client

83 .db('app')

README.mdView file

Lines 145-185markdown

145

146This is only a recommendation, not a requirement.

147

148You can also:

149

150- create EdgeBase as a completely separate project

151- keep frontend and backend in different repos

152- use a different subdirectory name if that fits your monorepo better

153

154The main thing we recommend is avoiding scaffolding directly into an existing app root unless that is intentionally how you want to organize the repo.

155

156## Quick Start

157

Lines 198-246markdown

198- `client.db(namespace, id?)`

199 Query tables, mutate records, and subscribe to live changes

200- `client.storage`

201 Upload files and resolve bucket URLs

202- `client.functions`

203 Call app functions from the browser

204- `client.room(namespace, roomId)`

205 Join realtime rooms for presence, state sync, and signals

206- `client.analytics`

207 Send analytics data from the client

208- `client.push`

209 Register and manage web push flows

210

211## Auth

212

213### Email and password

214

215```ts

216await client.auth.signUp({

217 email: 'june@example.com',

218 password: 'pass1234',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L218

219 data: {

220 displayName: 'June',

221 },

222});

223

224await client.auth.signIn({

225 email: 'june@example.com',

226 password: 'pass1234',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L226

227});

228

229client.auth.onAuthStateChange((user) => {

230 console.log('auth changed:', user);

231});

232```

233

234### OAuth

235

236```ts

237await client.auth.signInWithOAuth('google');

238

239const result = await client.auth.handleOAuthCallback();

240if (result) {

241 console.log('signed in with OAuth:', result.user);

242}

243```

244

245By default, the browser SDK uses `/auth/callback` on the current origin as the redirect target.

246