auth0-js 9.26.1 using deprecated version of superagent 7.6.1 which contains references to polyfills.io - responsible for a recent supply chain attack

[PriyankaRbakhshi]

Checklist

• [X] The issue can be reproduced in the auth0-js sample app (or N/A).
• [X] I have looked into the Readme and Examples, and have not found a suitable solution or answer.
• [X] I have looked into the API documentation and have not found a suitable solution or answer.
• [X] I have searched the issues and have not found a suitable solution or answer.
• [X] I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• [X] I agree to the terms within the Auth0 Code of Conduct.

Description

[email protected] has a dependency on superagent 7.6.1 which is deprecated. Superagent 7.6.1 contains a README.MD page which mentions about polyfills.io. polyfills.io has been recently linked to a supply chain attack, please see the links below:

https://www.spiceworks.com/it-security/cyber-risk-management/news/polyfill-supply-chain-attack-infects-websites/ https://www.sonatype.com/blog/polyfill.io-supply-chain-attack-hits-100000-websites-all-you-need-to-know

You can also find more details on the below site with examples : https://sansec.io/research/polyfill-supply-chain-attack

auth0-js should be updated to use latest superagent dependency version 9 and above.

Reproduction

npm install auth0-js npm ls superagent README.md

Additional context

We are installing auth0-js using npm and don't use scripts or cdn.

auth0-js version

9.26.1

Which browsers have you tested in?

Chrome

[PriyankaRbakhshi]

Hello, any update on this issue?

[arsekil]

I am curious aout this as well, since Auth0 recommends to use this library in conjunction with e.g. Auth0-React sdk.

BUMP!

[vavsab]

Since auth0 team is ignoring this just force it like here https://github.com/influxdata/ui/pull/6903/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R227

[fullstackzach]

If you are a pnpm user add this in pnpm-workspace.yaml

overrides:
  auth0-js>superagent: ^9.0.0

[amitsingh05667]

@PriyankaRbakhshi,

Thank you for reporting this issue, and apologies for the delayed response — we appreciate your patience. We are actively working on this and plan to release a fix in the coming days.

[jonathandv]

@amitsingh05667 I believe it should be at least version 9 of Superagent, so that this vulnerability will get fixed: CVE-2025-46653

[amitsingh05667]

@jonathandv , @PriyankaRbakhshi superagent dependency has been upgraded to the latest version to address the polyfills.io vulnerability.