@clerk/clerk-js

Clerk JS library

Latest 6.39.0

NPM

90%

Total Score

healthy

Active releases and broad project activity outweigh workflow hygiene findings.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 16 workflows were analyzed with no unpinned action references, untrusted checkouts, or script-injection findings. However, the audit found three high-confidence template-injection patterns and four high-confidence ad hoc package-install findings, so workflow hygiene warrants attention.

Vulnerabilities

Title	Versions	Severity
CVE-2025-63700 @clerk/clerk-js is vulnerable to Authentication Bypass by Spoofing in versions 0.0.0 - 5.88.0.	0.0.0 - 5.88.0	High
AIKIDO-2025-10556 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @clerk/clerk-js is vulnerable to Cross-site Scripting (XSS) in versions 4.0.0 - 5.82.0.	4.0.0 - 5.82.0	Medium
AIKIDO-2024-10335 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @clerk/clerk-js is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 2.13.1 - 5.26.3.	2.13.1 - 5.26.3	Medium

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
dequal Version 2.0.3	—	—
core-js Version 3.47.0	—	—
crypto-js Version ^4.2.0	—	—
@swc/helpers Version 0.5.21	—	—
@clerk/shared Version ^4.40.0	—	—