registry / @jskit-ai/auth-provider-supabase-core / 0.1.100

@jskit-ai/auth-provider-supabase-core@0.1.100

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime behavior is a Supabase auth provider that uses configured Supabase endpoints, cookies, JWT verification, OAuth, OTP, and password flows.

Static reason

One or more suspicious static signals were detected.

Trigger

Application explicitly registers/imports the Supabase auth provider or invokes its auth service methods.

Impact

Expected auth network calls and cookie/session management; no exfiltration or install-time mutation identified.

Mechanism

Package-aligned Supabase authentication integration

Rationale

Static source inspection found package-aligned Supabase auth functionality and descriptor-declared app config mutations, but no npm lifecycle execution, stealth persistence, broad agent control mutation, credential exfiltration, or remote payload execution. Scanner hits are explained by normal env-based auth configuration, Supabase network calls, and password/error handling.

Evidence

package.jsonpackage.descriptor.mjssrc/server/providers/AuthSupabaseServiceProvider.jssrc/server/lib/service.jssrc/server/lib/authErrorMappers.jssrc/server/lib/devAuthBootstrap.jssrc/server/lib/supabaseClientOptions.js.envconfig/server.js

Network endpoints1

${AUTH_SUPABASE_URL}/auth/v1/.well-known/jwks.json

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks; only test script and explicit exports.
src/server/providers/AuthSupabaseServiceProvider.js reads env to configure Supabase auth and rejects non-supabase AUTH_PROVIDER.
src/server/lib/service.js creates @supabase/supabase-js clients with configured URL/key and uses jose JWKS verification for Supabase auth.
src/server/lib/authErrorMappers.js only maps/sanitizes auth errors; scanner secret-pattern appears to be password/error text handling.
src/server/lib/devAuthBootstrap.js dev bypass requires explicit env enablement, non-production, localhost request, and secret.
No child_process, eval/Function, filesystem writes, credential harvesting, or AI-agent control-surface mutation found in runtime source.

Behavioral surface

Source

CryptoEnvironmentVarsWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 129 KB of source, external domains: your-project.supabase.co

Source & flagged code

4 flagged

src/server/lib/authErrorMappers.jsView file

Lines 127-172javascript

127 if (isTransientSupabaseError(error)) {

128 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

129 }

130

131 const status = Number(error?.status || error?.statusCode);

132 if (status === 429) {

133 return new AppError(429, "Too many recovery attempts. Please wait and try again.");

134 }

135

136 return new AppError(401, "Recovery link is invalid or has expired.");

137}

138

139function mapPasswordUpdateError(error) {

140 if (isTransientSupabaseError(error)) {

141 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

142 }

143

144 const message = String(error?.message || "").toLowerCase();

145 if (message.includes("same") && message.includes("password")) {

146 return createValidationError({

147 password: "New password must be different from the current password."

Medium

Secret Pattern

Package contains a possible secret pattern.

src/server/lib/authErrorMappers.jsView on unpkg · L147

148 });

149 }

150

151 return createValidationError({

152 password: "Unable to update password with the provided value."

Medium

Secret Pattern

Hardcoded password in src/server/lib/authErrorMappers.js

src/server/lib/authErrorMappers.jsView on unpkg · L152

153 });

154}

155

156function mapOtpVerifyError(error) {

157 if (isTransientSupabaseError(error)) {

158 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

159 }

160

161 return new AppError(401, "One-time code is invalid or expired.");

162}

163

164function mapProfileUpdateError(error) {

165 if (isTransientSupabaseError(error)) {

166 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

167 }

168

169 return validationError({

170 displayName: "Unable to update profile details."

171 });

172}

test/auth.provider.supabase.test.jsView file

Lines 214-254javascript

214 ok: true,

215 clearSession: true

216 });

217});

218

219test("supabase password reset consumes the recovery session reader", async () => {

220 let normalSessionReads = 0

Source & flagged code

4 flagged · loading source

src/server/lib/authErrorMappers.jsView file

147patternName = generic_password severity = medium line = 147 matchedText = password...rd."

Medium

Secret Pattern

Package contains a possible secret pattern.

src/server/lib/authErrorMappers.jsView on unpkg · L147

152patternName = generic_password severity = medium line = 152 matchedText = password...ue."

Medium

Secret Pattern

Hardcoded password in src/server/lib/authErrorMappers.js

src/server/lib/authErrorMappers.jsView on unpkg · L152

test/auth.provider.supabase.test.jsView file

234patternName = generic_password severity = medium line = 234 matchedText = assert.d... });

Medium

Secret Pattern

Hardcoded password in test/auth.provider.supabase.test.js

test/auth.provider.supabase.test.jsView on unpkg · L234

311patternName = generic_password severity = medium line = 311 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/auth.provider.supabase.test.js

test/auth.provider.supabase.test.jsView on unpkg · L311

Findings

5 Medium4 Low

MediumSecret Patternsrc/server/lib/authErrorMappers.js

MediumEnvironment Vars

MediumSecret Patterntest/auth.provider.supabase.test.js

MediumSecret Patternsrc/server/lib/authErrorMappers.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

src/server/lib/authErrorMappers.jsView file

Lines 127-172javascript

127 if (isTransientSupabaseError(error)) {

128 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

129 }

130

131 const status = Number(error?.status || error?.statusCode);

132 if (status === 429) {

133 return new AppError(429, "Too many recovery attempts. Please wait and try again.");

134 }

135

136 return new AppError(401, "Recovery link is invalid or has expired.");

137}

138

139function mapPasswordUpdateError(error) {

140 if (isTransientSupabaseError(error)) {

141 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

142 }

143

144 const message = String(error?.message || "").toLowerCase();

145 if (message.includes("same") && message.includes("password")) {

146 return createValidationError({

147 password: "New password must be different from the current password."

Medium

Secret Pattern

Package contains a possible secret pattern.

src/server/lib/authErrorMappers.jsView on unpkg · L147

148 });

149 }

150

151 return createValidationError({

152 password: "Unable to update password with the provided value."

Medium

Secret Pattern

Hardcoded password in src/server/lib/authErrorMappers.js

src/server/lib/authErrorMappers.jsView on unpkg · L152

153 });

154}

155

156function mapOtpVerifyError(error) {

157 if (isTransientSupabaseError(error)) {

158 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

159 }

160

161 return new AppError(401, "One-time code is invalid or expired.");

162}

163

164function mapProfileUpdateError(error) {

165 if (isTransientSupabaseError(error)) {

166 return new AppError(503, "Authentication service temporarily unavailable. Please retry.");

167 }

168

169 return validationError({

170 displayName: "Unable to update profile details."

171 });

172}

test/auth.provider.supabase.test.jsView file

Lines 214-254javascript

214 ok: true,

215 clearSession: true

216 });

217});

218

219test("supabase password reset consumes the recovery session reader", async () => {

220 let normalSessionReads = 0