@faable/auth-js@3.2.1
<p align="center"> <a href="https://faable.com"> <img src="https://www.faable.com/assets/logo/Emblem.png" height="96"> <h3 align="center">Faable</h3> </a> </p>
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK sends callback diagnostics and a short authorization-code prefix to its configured auth service when a callback stalls. Although this is documented in the declarations and limited to callback troubleshooting, reporting has no identified opt-out, so it is suspicious runtime telemetry.
Decision evidence
public snapshot- The callback watcher runs during initialization only when session detection is enabled in a browser URL containing an authorization code; it retains up to the code's first eight characters.
- After a callback stalls for 15 seconds, the client reports callback status, client ID, elapsed time, stage, and the code prefix to its configured auth domain.
- The type declarations describe sending the code prefix so the server can correlate the sign-in with generated-code and token logs.
- The report is sent to the configured Faable Auth domain, not a hard-coded unrelated collector.
- Reporting is conditional on an OAuth callback stalling or subsequently recovering; the code sends only a short prefix, not the full authorization code.
- The declarations document the callback reporting and code-prefix correlation.
Source & flagged code
4 flaggedThe callback watcher runs during initialization only when session detection is enabled in a browser URL containing an authorization code; it retains up to the code's first eight characters.
dist/main.jsView on unpkg · L6After a callback stalls for 15 seconds, the client reports callback status, client ID, elapsed time, stage, and the code prefix to its configured auth domain.
Findings
Affected versions and remediation
This report applies to @faable/auth-js@3.2.1.
See all versions of @faable/auth-js for other recorded verdicts.
- Review the evidence and your use of @faable/auth-js@3.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.