svelte

No evidence of intentional malware or supply-chain sabotage is present. The code implements ordinary authentication, but it contains two security issues: an unvalidated next parameter that may permit open redirects, and a process-global lastEmail value that can leak email addresses across users and requests. The redirect should be restricted to safe local paths, and lastEmail should be removed or stored in request/session-specific state.

No clear malware or sabotage is present. The primary security concern is potential disclosure of AUDIT_TOKEN by returning a server environment secret in page load data. Date parameters should be validated, and the global rates cache should be reviewed for staleness and tenant isolation. The fragment is otherwise readable and performs expected server-side data loading.