pwa-auth@3.7.4
Five elements: user-icon, user-drawer, user-login, user-settings, and email-reset. pwa- events, a small API, and --pwa_ theme variables.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe account changes flagged by the scanner are user initiated, but Firebase Analytics starts automatically after Firebase becomes ready and the package reports account events without an evident disclosure or opt-out. This is undisclosed runtime telemetry, so the package should receive a warning rather than a publish block.
Static reason
No blocking static signals were detected.
Trigger
After the integrator initializes Firebase and it becomes ready; account events are logged after signup or account deletion.
Impact
Allows runtime tracking of these account actions through the configured Firebase Analytics project. No credential theft or unrelated account action was identified.
Mechanism
The ready callback initializes Firebase Analytics when supported. The package then sends account creation and deletion event names through that instance; no telemetry opt-out is apparent in the inspected source.
AI rationale
The account changes flagged by the scanner are user initiated, but Firebase Analytics starts automatically after Firebase becomes ready and the package reports account events without an evident disclosure or opt-out. This is undisclosed runtime telemetry, so the package should receive a warning rather than a publish block.
Evidence
base/firebase/interface.jsbase/webcomponents/form/signup.jsbase/webcomponents/settings/input/delete.js
Network endpoints1
firebaseinstallations.googleapis.com/v1/projects/${t}/installations
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When Firebase is ready, the package initializes Firebase Analytics whenever the SDK reports it is supported.
- The package logs `create_account` and `delete_account` events through that Analytics instance.
- The signup flow calls the account event logger after creating an account.
Evidence against
- The events are sent through the Firebase application configured by the integrator; the source does not show credentials being sent to an unrelated host.
- Profile edits and account deletion are user initiated; deletion requires confirmation and reauthentication.
Behavioral surface
EnvironmentVarsEvalNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggedsource/pwa-auth.jsView file
193L194: `,Rn=function(t){const e=[];let n=0;for(let s=0;s<t.length;s++){let r=t.charCodeAt(s);r<128?e[n++]=r:r<2048?(e[n++]=r>>6|192,e[n++]=63&r|128):55296==(64512&r)&&s+1<t.length&&56320=...
L195:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
source/pwa-auth.jsView on unpkg · L1936L7: const t=globalThis,e=t.ShadowRoot&&(void 0===t.ShadyCSS||t.ShadyCSS.nativeShadow)&&"adoptedStyleSheets"in Document.prototype&&"replace"in CSSStyleSheet.prototype,n=Symbol(),s=new W...
L8:
...
L193:
L194: `,Rn=function(t){const e=[];let n=0;for(let s=0;s<t.length;s++){let r=t.charCodeAt(s);r<128?e[n++]=r:r<2048?(e[n++]=r>>6|192,e[n++]=63&r|128):55296==(64512&r)&&s+1<t.length&&56320=...
L195:
...
L349: input[type=email],
L350: input[type=password],
L351: select {
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
source/pwa-auth.jsView on unpkg · L6193L194: `,Rn=function(t){const e=[];let n=0;for(let s=0;s<t.length;s++){let r=t.charCodeAt(s);r<128?e[n++]=r:r<2048?(e[n++]=r>>6|192,e[n++]=63&r|128):55296==(64512&r)&&s+1<t.length&&56320=...
L195:
Findings
2 High4 Medium6 Low
HighSame File Env Network Executionsource/pwa-auth.js
HighBrowser Session Account Hijacksource/pwa-auth.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencebase/firebase/interface.js
MediumAi Review Evidencebase/firebase/interface.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalsource/pwa-auth.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to pwa-auth@3.7.4.
See all versions of pwa-auth for other recorded verdicts.
- Review the evidence and your use of pwa-auth@3.7.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.