@bygd/gd-sdk-pes@1.43.61
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection confirms that the SDK can send an existing visitor ID to its game-tracking service even after detecting an opt-out. This supports a warning for conditional data exposure, but the inspected request does not establish credential theft or a broader attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A game initializes the SDK with the GameDock tracker enabled and a visitor ID available, including when the SDK detects a tracking opt-out.
Impact
A visitor identifier may be disclosed to the tracking service after the user has opted out.
Mechanism
The tracker posts the visitor ID to a product tracking endpoint; the SDK forwards its opt-out state to a separate message router but does not use that state to guard this tracking call.
AI rationale
Source inspection confirms that the SDK can send an existing visitor ID to its game-tracking service even after detecting an opt-out. This supports a warning for conditional data exposure, but the inspected request does not establish credential theft or a broader attack.
Evidence
dist/default/esm/index.js
Network endpoints2
tracker-v4.gamedock.iotracker.gamedock.io
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest lists the related game SDK as a runtime dependency.
- The tracker sends an existing visitor ID to GameDock’s product tracking endpoint when tracking is not excluded.
- The SDK recognizes tracking opt-outs, but the default GameDock tracker still initializes and receives game data; the opt-out is passed to the message router rather than used to gate this tracking call.
Evidence against
- The reviewed request sends a visitor ID to a game-tracking service; the inspected source does not show credential theft or transmission of rich application records.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
7 flaggeddist/default/esm/index.jsView file
1import e from"@[redacted]";import t from"@[redacted]";import n from"@babel/runtime/helpers/typeof";import r from"@babel/runtime...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/default/esm/index.jsView on unpkg · L11nction e(t,n){var i,a,s,o,u,c,d;return r.wrap((function(e){for(;;)switch(e.prev=e.next){case 0:if(!this.checkIfExcluded(n)){e.next=3;break}return e.abrupt("return");case 3:if(s=null==t||null===(i=t.visitor)||void 0===i||null===(a=i.visitorData)||void 0===a?void 0:a.visitorId){e.next=6;break}return e.abrupt("return");case 6:return o=encodeURIComponent(this.productName),u=encodeURIComponen
Medium
Ai Review Evidence
The tracker sends an existing visitor ID to GameDock’s product tracking endpoint when tracking is not excluded.
dist/default/esm/index.jsView on unpkg · L110===a?void 0:a.visitorId){e.next=6;break}return e.abrupt("return");case 6:return o=encodeURIComponent(this.productName),u=encodeURIComponent(s),e.prev=8,c="https://tracker-v4.gamedock.io/v1/events-tracker/track/product/".concat(o,"/user_id/").concat(u),e.next=12,fetch(c,{method:"POST"});case 12:e.sent,e.next=28;break;case 15:return e.prev=15,e.t0=e.catch(8),console.log("GAME_DOCK. fail v4",e.t0),e.prev=18,d="https://tracker.gamedock.io
Findings
1 Critical7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/default/esm/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSuspicious Dependency Evidencepackage.json
MediumAi Review Evidencedist/default/esm/index.js
MediumAi Review Evidencedist/default/esm/index.js
MediumAi Review Evidencedist/default/esm/index.js
MediumAi Review Evidencedist/default/esm/index.js
LowScripts Present
LowEvaldist/default/esm/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bygd/gd-sdk-pes@1.43.61.
See all versions of @bygd/gd-sdk-pes for other recorded verdicts.
- Review the evidence and your use of @bygd/gd-sdk-pes@1.43.61 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.