registry / @websolutespa/bom-mixer-auth / 3.1.0
@websolutespa/bom-mixer-auth@3.1.0
Mixer Auth module of the BOM Repository
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest exposes library entrypoints without install hooks, and the inspected runtime sends user-submitted login and reset values to application authentication routes. The scanner’s network and secret signals did not establish a separate recipient, hidden transfer, or concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A user submits the login or password reset form.
Impact
No unrelated credential disclosure or other attack effect was established.
Mechanism
The library sends the submitted form values to the corresponding application authentication API route.
AI rationale
The manifest exposes library entrypoints without install hooks, and the inspected runtime sends user-submitted login and reset values to application authentication routes. The scanner’s network and secret signals did not establish a separate recipient, hidden transfer, or concrete attack.
Network endpoints2
/api/auth/login/auth/forgot/reset
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest points consumers to its client and server library exports and declares no install lifecycle hook.
- Login and password reset submit user-entered values to the application’s authentication API routes.
- The inspected iron-session dependency uses its exported session library code and has no install lifecycle hook.
Evidence against
- Static signals flagged network use and a possible secret pattern, but inspected requests belong to user-submitted authentication flows; no unrelated credential recipient or concrete attack behavior was identified.
Behavioral surface
Network
Source & flagged code
10 flaggeddist/index.jsView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg221patternName = generic_password
severity = medium
line = 221
Medium
331patternName = generic_password
severity = medium
line = 331
Medium
177const onSubmit = async (event) => {
event.preventDefault();
if (form.valid) try {
setError(void 0);
const user = await httpPost("/api/auth/login", form.value);
if (user) {
Findings
1 High7 Medium4 Low
HighSemantic Analysis Limiteddist/index.js
MediumSecret Patterndist/index.js
MediumNetwork
MediumSecret Patterndist/index.js
MediumSecret Patterndist/exports/server.js
MediumSecret Patternsrc/auth/auth-register.tsx
MediumSecret Patternsrc/auth/auth-login.tsx
MediumSecret Patternsrc/models/auth/auth.handler.ts
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @websolutespa/bom-mixer-auth@3.1.0.
See all versions of @websolutespa/bom-mixer-auth for other recorded verdicts.
- Review the evidence and your use of @websolutespa/bom-mixer-auth@3.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.