registry / @schemavaults/auth-react-provider / 0.18.7
@schemavaults/auth-react-provider@0.18.7
React hooks and components to make using the @schemavaults/auth-client-sdk a breeze
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and inspected runtime behavior is consistent with the package’s authentication purpose. Telemetry is directed to the configured auth server and uses credential omission and redaction, so the network and analysis-limit hints do not establish an attack.
Static reason
No blocking static signals were detected.
Trigger
The consumer imports the provider and renders it with application configuration, or an authentication flow reports an error.
Impact
No confirmed attack surface was established; observed network activity supports the configured authentication and error-reporting functions.
Mechanism
The provider initializes the auth SDK with the configured server and fetch function. Error reports go to that server without credentials and use report construction that redacts sensitive values and removes URL query strings.
AI rationale
The manifest has no install lifecycle hook, and inspected runtime behavior is consistent with the package’s authentication purpose. Telemetry is directed to the configured auth server and uses credential omission and redaction, so the network and analysis-limit hints do not establish an attack.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the React provider entrypoint and declares no install lifecycle hook; its scripts are build and cleanup tasks.
- The entrypoint exports the provider, hooks, and auth client SDK; provider initialization passes the configured auth server URL and fetch function into the client.
- The inspected dependency source contains authentication schemas, token helpers, OAuth and OIDC definitions, and MFA request functions consistent with an authentication SDK.
- The React adapter stores and clears session data and sends logout requests to configured session routes or the configured auth server.
- The SDK sends error reports to its configured auth server; reporting can be disabled, requests omit credentials, and report construction redacts sensitive values and strips URL query strings.
Evidence against
Behavioral surface
Network
HighEntropyStrings
NoLicense
Source & flagged code
8 flaggeddist/lib/react-auth-client-adapter.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/lib/react-auth-client-adapter.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@schemavaults/auth-react-provider",
"description": "React hooks and components to make using the @schemavaults/auth-client-sd
Low
Suspicious Lifecycle Evidence
package.json points to the React provider entrypoint and declares no install lifecycle hook; its scripts are build and cleanup tasks.
package.jsonView on unpkg · L1Findings
1 High1 Medium10 Low
HighSemantic Analysis Limiteddist/lib/react-auth-client-adapter.js#virtual:normalized:round1
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-76abc905-8d33-4ab5-9379-befb425e7294/1/npm-linux/dist/get-app-environment.cjs
LowSuspicious Dependency Evidence.lpm-dependency-evidence-76abc905-8d33-4ab5-9379-befb425e7294/1/npm-linux/dist/maybe-strip-quotes.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-76abc905-8d33-4ab5-9379-befb425e7294/1/npm-linux/dist/default-hardcoded-app-creation-time.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-76abc905-8d33-4ab5-9379-befb425e7294/1/npm-linux/dist/blank-uuid/index.js
Affected versions and remediation
This report applies to @schemavaults/auth-react-provider@0.18.7.
See all versions of @schemavaults/auth-react-provider for other recorded verdicts.
- Review the evidence and your use of @schemavaults/auth-react-provider@0.18.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.