pwa-auth@3.7.0
Five elements: user-icon, user-drawer, user-login, user-settings, and email-reset. pwa- events, a small API, and --pwa_ theme variables.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically initializes Firebase Analytics after Firebase setup, without a documented package-level opt-out. This is a runtime telemetry concern; the account-count events themselves are tied to explicit account actions.
Static reason
No blocking static signals were detected.
Trigger
The consumer initializes the Firebase app; on supported browser environments the interface initializes Firebase Analytics.
Impact
Undisclosed or unexpected runtime analytics collection is a privacy risk; the inspected package code shows no collection-disable control.
Mechanism
getAnalytics(application) initializes the Firebase Analytics SDK, which loads Google’s gtag script. The package also logs account creation and deletion events during those user actions.
AI rationale
The package automatically initializes Firebase Analytics after Firebase setup, without a documented package-level opt-out. This is a runtime telemetry concern; the account-count events themselves are tied to explicit account actions.
Evidence
base/firebase/interface.jssource/pwa-auth.jsREADME.md
Network endpoints1
www.googletagmanager.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After Firebase initialization, the interface automatically checks analytics support and calls getAnalytics(application); no collection opt-out is exposed in that path.
- The bundled Firebase Analytics SDK references https://www.googletagmanager.com/gtag/js.
- The README describes account-count events as occurring “if Analytics is on” but does not document that the package initializes Analytics automatically or provide a disable control.
- Analytics also records account creation and deletion counts; signup calls the creation event after account creation, and deletion requires confirmation and reauthentication.
Evidence against
- The package has no install-time hook; prepublishOnly runs build steps.
- The account events concern the package’s stated authentication purpose and are triggered by account actions.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsPossibleObfuscation
Source & flagged code
5 flaggedsource/pwa-auth.jsView file
193L194: `,Rn=function(t){const e=[];let n=0;for(let s=0;s<t.length;s++){let r=t.charCodeAt(s);r<128?e[n++]=r:r<2048?(e[n++]=r>>6|192,e[n++]=63&r|128):55296==(64512&r)&&s+1<t.length&&56320=...
L195:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
source/pwa-auth.jsView on unpkg · L1936L7: const t=globalThis,e=t.ShadowRoot&&(void 0===t.ShadyCSS||t.ShadyCSS.nativeShadow)&&"adoptedStyleSheets"in Document.prototype&&"replace"in CSSStyleSheet.prototype,n=Symbol(),s=new W...
L8:
...
L193:
L194: `,Rn=function(t){const e=[];let n=0;for(let s=0;s<t.length;s++){let r=t.charCodeAt(s);r<128?e[n++]=r:r<2048?(e[n++]=r>>6|192,e[n++]=63&r|128):55296==(64512&r)&&s+1<t.length&&56320=...
L195:
...
L344: input[type=email],
L345: input[type=password],
L346: select {
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
source/pwa-auth.jsView on unpkg · L6607nalytics",ZD="https://www.googletagmanager.com/gtag/js",t_=new ms("@firebase/analytics"),e_=new Yn("analytics","Analytics",{"already-exists":"A Fireba
Findings
2 High4 Medium6 Low
HighSame File Env Network Executionsource/pwa-auth.js
HighBrowser Session Account Hijacksource/pwa-auth.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencebase/firebase/interface.js
MediumAi Review Evidencesource/pwa-auth.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalsource/pwa-auth.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to pwa-auth@3.7.0.
See all versions of pwa-auth for other recorded verdicts.
- Review the evidence and your use of pwa-auth@3.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.