registry / @faable/auth-js / 2.21.0

@faable/auth-js@2.21.0

<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The entry points and package metadata match an authentication SDK, with no install hooks or fixed unrelated network destination identified. Requests use the configured auth domain, and token handling and session refresh match the stated purpose.

Static reason

No blocking static signals were detected.

Trigger

Consumers import the library and create a client to use its authentication features.

Impact

Expected authentication traffic and session storage for the caller’s application.

Mechanism

Authentication requests use the configured domain, with tokens supplied to request helpers and session state managed through the documented storage adapters.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package metadata exposes the main and Next.js authentication library entry points, marks the package side-effect-free, and declares no lifecycle scripts.
The client normalizes the caller-provided domain and uses it as the issuer, rather than selecting a fixed unrelated host.
Authorization headers are built from tokens supplied to the request helper, consistent with normal authenticated API calls.
The README describes OAuth, passwordless login, token refresh, and browser storage as the package’s purpose.

Evidence against

The library handles access tokens and persists authentication state in browser storage, which is expected for an authentication client.
Creating a client initializes session handling; this behavior is part of the documented authentication flow.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

package.jsonView file

1{ "name": "@faable/auth-js", "main": "dist/main.js", "dependencies": { "jose": "^6.2.12" }, "peerDependencies": { "next": ">=13" }, "peerDependenciesMeta": { "next": { "optional": true } }, "types": "dist/dts/entrypoints/main.es.d.ts", "exports": { ".": { "types": "./dist/dts/entrypoints/main.es.d.ts", "default": "./dist/main.js" }, "./nextjs": { "types": "./dist/dts/nextjs/index.d.ts", "default": "./dist/nextjs.js" }, "./package.json": "./package.json" }, "sideEffects": false, "version": "2.21.0", "t

Low

Suspicious Lifecycle Evidence

Package metadata exposes the main and Next.js authentication library entry points, marks the package side-effect-free, and declares no lifecycle scripts.

package.jsonView on unpkg · L1

dist/main.jsView file

6n(null==e?void 0:e.token)&&(t=r(r({},t),{Authorization:"Bearer ".concat(null==e?void 0:e.token)})),r(r({},null==e?void 0:e.headers),t)},U=function(e){if("string"==typeof e)return e

Medium

Stripped Provenance Metadata

Authorization headers are built from tokens supplied to the request helper, consistent with normal authenticated API calls.

dist/main.jsView on unpkg · L6

Findings

2 Medium5 Low

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/main.js

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/main.js

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @faable/auth-js@2.21.0.

See all versions of @faable/auth-js for other recorded verdicts.

Review the evidence and your use of @faable/auth-js@2.21.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:31:15.096Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @faable/auth-js / 2.21.0

@faable/auth-js@2.21.0

<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Consumers import the library and create a client to use its authentication features.

Impact

Expected authentication traffic and session storage for the caller’s application.

Mechanism

Authentication requests use the configured domain, with tokens supplied to request helpers and session state managed through the documented storage adapters.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package metadata exposes the main and Next.js authentication library entry points, marks the package side-effect-free, and declares no lifecycle scripts.
The client normalizes the caller-provided domain and uses it as the issuer, rather than selecting a fixed unrelated host.
Authorization headers are built from tokens supplied to the request helper, consistent with normal authenticated API calls.
The README describes OAuth, passwordless login, token refresh, and browser storage as the package’s purpose.

Evidence against

The library handles access tokens and persists authentication state in browser storage, which is expected for an authentication client.
Creating a client initializes session handling; this behavior is part of the documented authentication flow.

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsMinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

package.jsonView file

Low

Suspicious Lifecycle Evidence

Package metadata exposes the main and Next.js authentication library entry points, marks the package side-effect-free, and declares no lifecycle scripts.

package.jsonView on unpkg · L1

dist/main.jsView file

6n(null==e?void 0:e.token)&&(t=r(r({},t),{Authorization:"Bearer ".concat(null==e?void 0:e.token)})),r(r({},null==e?void 0:e.headers),t)},U=function(e){if("string"==typeof e)return e

Medium

Stripped Provenance Metadata

Authorization headers are built from tokens supplied to the request helper, consistent with normal authenticated API calls.

dist/main.jsView on unpkg · L6

Findings

2 Medium5 Low

MediumEnvironment Vars

MediumStripped Provenance Metadatadist/main.js

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/main.js

LowAi Review EvidenceREADME.md

Affected versions and remediation

This report applies to @faable/auth-js@2.21.0.

See all versions of @faable/auth-js for other recorded verdicts.

Review the evidence and your use of @faable/auth-js@2.21.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 14:31:15.096Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.