registry / @ferrumec/auth / 0.2.1

@ferrumec/auth@0.2.1

Framework-agnostic, pluggable authentication for React applications — session management, token refresh, HTTP client, and reusable auth UI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network activity implements user-configured authenticated API and OAuth/OIDC requests.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer initializes an auth provider or calls its HTTP client.

Impact

Authentication tokens are sent only to configured API/OAuth endpoints as expected by the package purpose.

Mechanism

Configured fetch-based authentication, token refresh, and OAuth flows.

Rationale

The flagged network and token patterns are core, user-configured authentication behavior, not covert collection or exfiltration. Static inspection found no install-time execution, persistence, destructive behavior, or remote payload execution.

Evidence

package.jsondist/index.cjs.jsREADME.md

Network endpoints3

${config.domain}login.microsoftonline.com/${config.tenantId}/oauth2/v2.0graph.microsoft.com/oidc/userinfo

Decision evidence

public snapshot

AI called this Clean at 98.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks.
dist/index.cjs.js only sends fetch requests through configured auth/API endpoints.
Token storage is explicit browser localStorage/sessionStorage functionality.
No child-process, filesystem, eval, VM, environment, or dynamic-import APIs found.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 130 KB of source, external domains: graph.microsoft.com, login.microsoftonline.com

Source & flagged code

4 flagged

dist/index.cjs.jsView file

Lines 1127-1167javascript

1127 const { user, loading, authenticated, events } = useAuth();

1128 (0, import_react4.useEffect)(() => {

1129 if (!handlers) return;

1130 const unsubscribers = Object.keys(handlers).map(

1131 (event) => events.on(event, handlers[event])

1132 );

1133 return () => unsubscribers.forEach((unsub) => unsub());

1134 }, [events]);

1135 return { user, loading, authenticated };

1136}

1137

1138// src/components/LoginPage.tsx

1139var import_react6 = require("react");

1140

1141// src/components/LoginForm.tsx

1142var import_react5 = require("react");

1143var import_jsx_runtime4 = require("react/jsx-runtime");

1144function validate(identifier, password) {

1145 const errors = {};

1146 if (!identifier.trim()) errors.identifier = "Enter your email or username.";

1147 if (!password) errors.password = "Enter your password.";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjs.jsView on unpkg · L1147

1148 return errors;

1149}

1150function LoginForm({

1151 onSubmit,

1152 loading = false,

1153 error,

1154 className,

1155 identifierLabel = "Email or username",

1156 showRememberMe = true

1157}) {

1158 const [identifier, setIdentifier] = (0, import_react5.useState)("");

1159 const [password, setPassword] = (0, import_react5.useState)("");

1160 const [rememberMe, setRememberMe] = (0, import_react5.useState)(false);

1161 const [fieldErrors, setFieldErrors] = (0, import_react5.useState)({});

1162 const handleSubmit = async (e) => {

1163 e.preventDefault();

1164 const errors = validate(identifier, password);

1165 setFieldErrors(errors);

1166 if (Object.keys(errors).length > 0) return;

1167 await onSubmit({ identifier, password, rememberMe });

Lines 1277-1317javascript

1277 }

1278 );

1279}

1280

1281// src/components/RegisterPage.tsx

1282var import_react9 = require("react");

1283

1284// src/components/RegisterForm.tsx

1285var import_react7 = require("react");

1286var import_jsx_runtime6 = require

dist/index.esm.jsView file

Lines 1070-1110javascript

1070 const { user, loading, authenticated, events } = useAuth();

1071 useEffect2(() => {

1072 if (!handlers) return;

1073 const unsubscribers = Object.

Source & flagged code

4 flagged · loading source

dist/index.cjs.jsView file

1147patternName = generic_password severity = medium line = 1147 matchedText = if (!pas...d.";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjs.jsView on unpkg · L1147

1297patternName = generic_password severity = medium line = 1297 matchedText = errors.p...d.";

Medium

Secret Pattern

Hardcoded password in dist/index.cjs.js

dist/index.cjs.jsView on unpkg · L1297

dist/index.esm.jsView file

1090patternName = generic_password severity = medium line = 1090 matchedText = if (!pas...d.";

Medium

Secret Pattern

Hardcoded password in dist/index.esm.js

dist/index.esm.jsView on unpkg · L1090

1240patternName = generic_password severity = medium line = 1240 matchedText = errors.p...d.";

Medium

Secret Pattern

Hardcoded password in dist/index.esm.js

dist/index.esm.jsView on unpkg · L1240

Findings

5 Medium3 Low

MediumSecret Patterndist/index.cjs.js

MediumNetwork

MediumSecret Patterndist/index.cjs.js

MediumSecret Patterndist/index.esm.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.cjs.jsView file

Lines 1127-1167javascript

1127 const { user, loading, authenticated, events } = useAuth();

1128 (0, import_react4.useEffect)(() => {

1129 if (!handlers) return;

1130 const unsubscribers = Object.keys(handlers).map(

1131 (event) => events.on(event, handlers[event])

1132 );

1133 return () => unsubscribers.forEach((unsub) => unsub());

1134 }, [events]);

1135 return { user, loading, authenticated };

1136}

1137

1138// src/components/LoginPage.tsx

1139var import_react6 = require("react");

1140

1141// src/components/LoginForm.tsx

1142var import_react5 = require("react");

1143var import_jsx_runtime4 = require("react/jsx-runtime");

1144function validate(identifier, password) {

1145 const errors = {};

1146 if (!identifier.trim()) errors.identifier = "Enter your email or username.";

1147 if (!password) errors.password = "Enter your password.";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.cjs.jsView on unpkg · L1147

1148 return errors;

1149}

1150function LoginForm({

1151 onSubmit,

1152 loading = false,

1153 error,

1154 className,

1155 identifierLabel = "Email or username",

1156 showRememberMe = true

1157}) {

1158 const [identifier, setIdentifier] = (0, import_react5.useState)("");

1159 const [password, setPassword] = (0, import_react5.useState)("");

1160 const [rememberMe, setRememberMe] = (0, import_react5.useState)(false);

1161 const [fieldErrors, setFieldErrors] = (0, import_react5.useState)({});

1162 const handleSubmit = async (e) => {

1163 e.preventDefault();

1164 const errors = validate(identifier, password);

1165 setFieldErrors(errors);

1166 if (Object.keys(errors).length > 0) return;

1167 await onSubmit({ identifier, password, rememberMe });

Lines 1277-1317javascript

1277 }

1278 );

1279}

1280

1281// src/components/RegisterPage.tsx

1282var import_react9 = require("react");

1283

1284// src/components/RegisterForm.tsx

1285var import_react7 = require("react");

1286var import_jsx_runtime6 = require

dist/index.esm.jsView file

Lines 1070-1110javascript

1070 const { user, loading, authenticated, events } = useAuth();

1071 useEffect2(() => {

1072 if (!handlers) return;

1073 const unsubscribers = Object.

Lines 1220-1260javascript

1220 }

1221 );

1222}

1223

1224// src/components/RegisterPage.tsx

1225import { useState as useState6 } from "react";

1226

1227// src/components/RegisterForm.tsx

1228import { useState as useState4 } from "react";

1229import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";

1230var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;

1231function validate2(values, minPasswordLength, showConfirmPassword) {

1232 const errors = {};

1233 if (!values.username.trim()) errors.username = "Choose a username.";

1234 if (!values.email.trim()) {

1235 errors.email = "Enter your email address.";

1236 } else if (!EMAIL_PATTERN.test(values.email.trim())) {

1237 errors.email = "Enter a valid email address.";

1238 }

1239 if (!values.password) {

1240 errors.password = "Choose a password.";

Medium

Secret Pattern

Hardcoded password in dist/index.esm.js

dist/index.esm.jsView on unpkg · L1240

1241 } else if (values.password.length < minPasswordLength) {

1242 errors.password = `Password must be at least ${minPasswordLength} characters.`;

1243 }

1244 if (showConfirmPassword && values.confirmPassword !== values.password) {

1245 errors.confirmPassword = "Passwords don't match.";

1246 }

1247 return errors;

1248}

1249function RegisterForm({

1250 onSubmit,

1251 loading = false,

1252 error,

1253 className,

1254 usernameLabel = "Username",

1255 emailLabel = "Email address",

1256 minPasswordLength = 8,

1257 showConfirmPassword = true

1258}) {

1259 const [username, setUsername] = useState4("");

1260 const [email, setEmail] = useState4("");