registry / Telemetry / @faable/auth-js

@faable/auth-js

<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>

This report shows the evidence for @faable/auth-js@3.2.3. 0 of 34 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The package automatically sends runtime callback telemetry, including an OAuth code prefix, to the configured auth service, with no apparent opt-out. This is a telemetry concern rather than evidence of credential theft or unrelated data collection.

Static reason

No blocking static signals were detected.

Trigger

A sign-in callback stalls for 15 seconds, or a previously stalled callback recovers.

Impact

The authentication service receives callback and sign-in correlation data without an apparent user control to disable reporting.

Mechanism

The SDK posts the client ID, event, callback stage, elapsed time, and, when available, a callback code prefix to the configured authentication domain's /sdk/report endpoint. No opt-out was identified.

AI rationale

Evidence

dist/main.jsdist/dts/FaableAuthClient.d.ts

Network endpoints1

<configured authentication domain>/sdk/report

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

A callback that remains stalled for 15 seconds automatically reports a callback_stalled event; recovery after a stall also reports callback_recovered.
The report sends the client ID, event, callback stage, and callback code prefix to domainUrl/sdk/report.
Package comments say the callback code prefix is sent with every report to correlate sign-in logs.

Evidence against

The manifest has no lifecycle scripts and exports JavaScript library entry points.
Reports go to the configured authentication domain and contain callback diagnostics rather than unrelated host or project data.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 185 KB of source, external domains: auth0.com, faable.com, schemas.openid.net

Source & flagged code

3 flagged

dist/main.jsView file

6Date.now(),stalled:!1,timer:setTimeout(function(){n.stalled=!0,t._reportSdk("callback_stalled",{elapsed_ms:Date.now()-n.startedAt})},15e3)};return this._setCallbackStage("lock_wait"),n},c.prototype._endCallbackWatch=function(e,t){clearTimeout(e.timer),e.stalled&&(this._setCallbackStage(t&&!t.error?"done":"failed"),this._reportSdk("callback_recovered",{elapsed_ms:Date.now()-e.startedAt}))},c.prototype._setCallbackStage=function(e){null==

Medium

Ai Review Evidence

A callback that remains stalled for 15 seconds automatically reports a callback_stalled event; recovery after a stall also reports callback_recovered.

dist/main.jsView on unpkg · L6

6n=r({client_id:this.clientId,event:e},t);this._callbackStage&&(n.stage=this._callbackStage),this._callbackCodePrefix&&(n.code_prefix=this._callbackCodePrefix),this._debug("#_reportSdk",e,n),R("".concat(this.domainUrl,"/sdk/report"),{method:"POST",keepalive:!0,headers:{"Content-Type":"application/json","x-faable-client":"auth-js/".concat(a,"+").concat(u)},body:JSON.stringify(n)}).catch(function(){})}catch(e){}},Object.defineProperty(c.prototype,"lastInitializeResult",{get:function(){return this._lastInitializeResult},enumerable:!1,configurable:!0}),Object.definePr

Medium

Ai Review Evidence

The report sends the client ID, event, callback stage, and callback code prefix to domainUrl/sdk/report.

dist/main.jsView on unpkg · L6

Findings

4 Medium2 Low

MediumEnvironment Vars

MediumAi Review Evidencedist/main.js

MediumAi Review Evidencedist/dts/FaableAuthClient.d.ts

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @faable/auth-js@3.2.3.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @faable/auth-js@3.2.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 13:41:58.682Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

34 known versions

3.2.3latestshownSuspiciousTelemetryWarnPublishedNov 4, 2026, 1:34 PM 3.2.1SuspiciousTelemetryWarnPublishedOct 31, 2026, 10:53 AM 3.2.0Clean—AllowPublishedOct 30, 2026, 7:02 AM 3.1.0SuspiciousTelemetryWarnPublishedOct 29, 2026, 8:14 PM

registry / Telemetry / @faable/auth-js

@faable/auth-js

<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>

This report shows the evidence for @faable/auth-js@3.2.3. 0 of 34 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A sign-in callback stalls for 15 seconds, or a previously stalled callback recovers.

Impact

The authentication service receives callback and sign-in correlation data without an apparent user control to disable reporting.

Mechanism

AI rationale

Evidence

dist/main.jsdist/dts/FaableAuthClient.d.ts

Network endpoints1

<configured authentication domain>/sdk/report

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

A callback that remains stalled for 15 seconds automatically reports a callback_stalled event; recovery after a stall also reports callback_recovered.
The report sends the client ID, event, callback stage, and callback code prefix to domainUrl/sdk/report.
Package comments say the callback code prefix is sent with every report to correlate sign-in logs.

Evidence against

The manifest has no lifecycle scripts and exports JavaScript library entry points.
Reports go to the configured authentication domain and contain callback diagnostics rather than unrelated host or project data.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 185 KB of source, external domains: auth0.com, faable.com, schemas.openid.net

Source & flagged code

3 flagged

dist/main.jsView file

Medium

Ai Review Evidence

A callback that remains stalled for 15 seconds automatically reports a callback_stalled event; recovery after a stall also reports callback_recovered.

dist/main.jsView on unpkg · L6

Medium

Ai Review Evidence

The report sends the client ID, event, callback stage, and callback code prefix to domainUrl/sdk/report.

dist/main.jsView on unpkg · L6

Findings

4 Medium2 Low

MediumEnvironment Vars

MediumAi Review Evidencedist/main.js

MediumAi Review Evidencedist/dts/FaableAuthClient.d.ts

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @faable/auth-js@3.2.3.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of @faable/auth-js@3.2.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 13:41:58.682Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

34 known versions