registry / @bygd/gd-sdk-pes / 1.43.62
@bygd/gd-sdk-pes@1.43.62
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected runtime sends contextual tracking data to GameDistribution endpoints, including on an ad-event path without a visible opt-out check. This is a concrete privacy risk, but the source does not establish a malicious or unrelated transfer, so a warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An ad request starts in the SDK.
Impact
This permits tracking context to be sent despite an opt-out flag; the inspected behavior does not establish credential theft or an unrelated attack.
Mechanism
The SDK sends the event with page, referrer, game, and browser or device context to a GameDistribution telemetry endpoint.
AI rationale
The inspected runtime sends contextual tracking data to GameDistribution endpoints, including on an ad-event path without a visible opt-out check. This is a concrete privacy risk, but the source does not establish a malicious or unrelated transfer, so a warning is appropriate.
Evidence
dist/default/esm/index.jsdist/default/iife/index.js
Network endpoints2
tag.atom.gamedistribution.commsgrt.gamedistribution.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The ESM bundle sends ad events with page URL, referrer, game details, event arguments, and browser or device context to tag.atom.gamedistribution.com.
- The bundle detects tracking opt-out flags, but the inspected ad-event send path has no corresponding consent check. A separate telemetry path also sends collected context to msgrt.gamedistribution.com.
- The manifest declares build and deployment scripts but no install lifecycle hook.
Evidence against
- The observed destinations are under gamedistribution.com, matching the package’s game SDK purpose.
- The inspected telemetry payload contains contextual event and device data; it does not show credentials or file contents.
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
7 flaggeddist/default/esm/index.jsView file
1import e from"@[redacted]";import t from"@[redacted]";import n from"@babel/runtime/helpers/typeof";import r from"@babel/runtime...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/default/esm/index.jsView on unpkg · L11key:"_send",value:function(e,t){try{var n=this.msgrt,r=n._layout,i=n._ua,a={tp:e,ct:0,vrs:this.PackageJSON.version,url:this.parentURL,rfr:document.referrer,tdmn:this.topDomain||this.parentDomain,dpth:0,args:t,ua:{brnm:i.browser.name,brvs:i.browser.version,osnm:i.os.name,osvs:i.os.version,dvmd:i.device.model,w:r.w,h:r.h}};return fetch("https://tag.atom.gamedistribution.com/v1/dmp?ar=".concat(encodeURIComponent(O.encode(JSON.stringify(a)))))}catch(e){}}},{key:"_send_atom_event",value:function(e,t)
Medium
Ai Review Evidence
The ESM bundle sends ad events with page URL, referrer, game details, event arguments, and browser or device context to tag.atom.gamedistribution.com.
dist/default/esm/index.jsView on unpkg · L11rev=e.next){case 0:if(a="rewarded"===n.adTypeFound?"reward":n.adTypeFound,this._send_atom_event("opus-ad.start"),!this.requestRunning){e.next=8;break}return this._broadcast("AD_IS_ALREADY_RUNNING",{status:"warning"}),this._broadcast("AD_ERROR",{message:"Ad is already running",status:"error",reason:"request-running"}),this._send_atom_event("opus-ad.already-ru
Findings
1 Critical7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/default/esm/index.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/default/esm/index.js
MediumAi Review Evidencedist/default/esm/index.js
MediumAi Review Evidencedist/default/esm/index.js
MediumAi Review Evidencedist/default/iife/index.js
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowEvaldist/default/esm/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bygd/gd-sdk-pes@1.43.62.
See all versions of @bygd/gd-sdk-pes for other recorded verdicts.
- Review the evidence and your use of @bygd/gd-sdk-pes@1.43.62 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.