registry / @bygd/gd-sdk-pes / 1.43.59
@bygd/gd-sdk-pes@1.43.59
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe flagged network behavior is product tracking that sends an existing visitor identifier to GameDock, with exclusion and missing-identifier checks. The manifest has no install hook, and the inspected source establishes no concrete attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
SDK setup invokes the tracker when tracking data is available.
Impact
The code discloses a visitor identifier for product tracking; the inspected source establishes no unrelated recipient or concrete attack.
Mechanism
The tracker skips excluded games and missing visitor identifiers, then sends the identifier to a GameDock tracking endpoint.
AI rationale
The flagged network behavior is product tracking that sends an existing visitor identifier to GameDock, with exclusion and missing-identifier checks. The manifest has no install hook, and the inspected source establishes no concrete attack surface.
Evidence
dist/default/esm/index.jsdist/default/cjs/index.jsdist/default/iife/index.js
Network endpoints2
tracker-v4.gamedock.iotracker.gamedock.io
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest lists build, watch, and deploy scripts; it has no install lifecycle hook.
- The tracker sends an existing visitor identifier to a GameDock product-tracking endpoint and skips sending when excluded or when the identifier is absent.
- The SDK calls the tracker during its setup flow.
- The CJS and browser IIFE builds contain the same GameDock user-tracking request.
Evidence against
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
7 flaggeddist/default/esm/index.jsView file
1import e from"@[redacted]";import t from"@[redacted]";import n from"@babel/runtime/helpers/typeof";import r from"@babel/runtime...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/default/esm/index.jsView on unpkg · L11import e from"@[redacted]";import t from"@[redacted]";import n from"@babel/runtime/helpers/typeof";import r from"@babel/runtime...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/default/esm/index.jsView on unpkg · L11",value:function(e){try{var t,n;return!(null===(t=e.diagnostic)||void 0===t||null===(n=t.gameDock)||void 0===n||!n.excluded)}catch(e){return console.log("Error on checkIfExclude check",e),!1}}},{key:"track",value:(n=e(r.mark((function e(t,n){var i,a,s,o,u,c,d;return r.wrap((function(e){for(;;)switch(e.prev=e.next){case 0:if(!this.checkIfExcluded(n)){e.next=3;break}return e.abrupt("return");case 3:if(s=null==t||null===(i=t.visitor)||void 0===i||null===(a=i.visitorData)||void 0===a?void 0:a.visitorId){e.next=6;break}return e.abrupt("return");case 6:return o=encodeURIComponent(this.productName),u
Findings
1 Critical2 Medium9 Low
CriticalHardcoded Runtime Data Exfiltrationdist/default/esm/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/default/esm/index.js
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/default/esm/index.js
LowAi Review Evidencedist/default/esm/index.js
LowAi Review Evidencedist/default/esm/index.js
LowAi Review Evidencedist/default/cjs/index.js
Affected versions and remediation
This report applies to @bygd/gd-sdk-pes@1.43.59.
See all versions of @bygd/gd-sdk-pes for other recorded verdicts.
- Review the evidence and your use of @bygd/gd-sdk-pes@1.43.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.