Hi Julia,
That _auto.js is not part of our plugin. It is most probably generated by some javascript minifier plugin that you are using.

1. I just had a look at the screenshot attached and if you see the code is from some WooCommerce related plugin in that file and not from ajax register. I can assure you that we are not adding it and you can verify the same by looking at the code.

2. The size of the plugin is 38.8KB zipped since it includes a lightbox and css for lightbox. The lightbox is Magnific Popup.

3. Auto activation is part of experience,. It emulates other social networks where a user gets logged in as soon s they create account. I can post a code to disable auto activation. That will disable auto login too.

4. We are not adding any specific style. Very minimal and only layout structure. It will not inherit from BuddyPress as BuddyPress css is mostly namespanced under #buddypress but it will inherit from your theme’s default style for form/buttons.

5. There is no security risk. If you think that you can check the name of the plugin directory in the browser, that is not a security risk. It is needed by all plugins who want to add some asset(js/css/images). I will suggest opening View Source and you will see your theme directory/plugins directory etc. It’s not a security risk. Non sanitized, improperly written coders are security risk.

Hope that clarifies.

Regards
Brajesh