pwa-auth@3.7.1
Five elements: user-icon, user-drawer, user-login, user-settings, and email-reset. pwa- events, a small API, and --pwa_ theme variables.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source implements Firebase sign-in components and initializes services from the app's Firebase configuration. The flagged account operations are user-requested, and deletion is gated by confirmation and reauthentication; analytics records only account creation and deletion event names.
Decision evidence
public snapshot- The package describes and exports Firebase sign-in UI components and account functions.
- The prepublishOnly script runs build and rollup; no install lifecycle hook is declared.
- Firebase initializes from supplied configuration or a legacy Firebase config value.
- Analytics reports only create_account and delete_account through the configured Firebase app.
- Account deletion requires a password, a confirmation prompt, and successful reauthentication.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
source/pwa-auth.jsView on unpkg · L193Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
source/pwa-auth.jsView on unpkg · L6Findings
Affected versions and remediation
This report applies to pwa-auth@3.7.1.
See all versions of pwa-auth for other recorded verdicts.
- Review the evidence and your use of pwa-auth@3.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.