pwa-auth@3.6.0
Five elements: user-icon, user-drawer, user-login, user-settings, and email-reset. pwa- events, a small API, and --pwa_ theme variables.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged browser behavior is Firebase Analytics reporting of account events through the consuming app's configuration, and the README documents the corresponding events. I found no unrelated account mutations, credential forwarding, or malicious install behavior.
Decision evidence
public snapshot- The package exports browser authentication components and a production bundle; its only lifecycle script is prepublishOnly.
- Firebase Analytics sends create_account and delete_account events after the corresponding account flows.
- The README documents the matching Analytics events and uses an app-specific Firebase configuration.
- The account events report only their event names through Firebase Analytics configured for the consuming app.
- Account creation and deletion events follow the signup and delete-account flows; no unrelated account actions or credential forwarding were identified.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
source/pwa-auth.jsView on unpkg · L215Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
source/pwa-auth.jsView on unpkg · L6Findings
Affected versions and remediation
This report applies to pwa-auth@3.6.0.
See all versions of pwa-auth for other recorded verdicts.
- Review the evidence and your use of pwa-auth@3.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.