@bygd/gd-sdk-pes@1.43.63
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged transfer is gated by remote event settings and tied to ad handling on the SDK’s own service, so the source does not establish credential theft or unrelated exfiltration. Because the runtime telemetry includes page and device context without clear user-facing disclosure in the inspected source, warn rather than block.
Decision evidence
public snapshot- The Atom event sender runs only when remote game configuration enables dbglg and allowlists the event topic.
- The payload includes page URL, referrer, domain, browser/OS/device details, and event arguments.
- The encoded payload is sent to tag.atom.gamedistribution.com/v1/dmp.
- The sender is called during ad startup, including when an ad is already running.
- The telemetry is limited to configured ad events and goes to a GameDistribution host, consistent with the SDK’s advertising purpose.
- The package manifest declares build, watch, and deploy scripts, with no install lifecycle script shown.
Source & flagged code
6 flaggedSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/default/esm/index.jsView on unpkg · L1The Atom event sender runs only when remote game configuration enables dbglg and allowlists the event topic.
dist/default/esm/index.jsView on unpkg · L1The payload includes page URL, referrer, domain, browser/OS/device details, and event arguments.
Findings
Affected versions and remediation
This report applies to @bygd/gd-sdk-pes@1.43.63.
See all versions of @bygd/gd-sdk-pes for other recorded verdicts.
- Review the evidence and your use of @bygd/gd-sdk-pes@1.43.63 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.