registry / @prosopo/procaptcha-bundle / 4.1.49
@prosopo/procaptcha-bundle@4.1.49
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic source inspection shows a browser captcha bundle with normal widget initialization and same-vendor lazy imports. Scanner signals for environment variables and dynamic imports do not form a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Application imports the bundle or loads its browser script.
Impact
No install-time execution, secret exfiltration, persistence, or destructive behavior established.
Mechanism
Captcha-widget initialization and package-aligned lazy dependency loading.
AI rationale
Static source inspection shows a browser captcha bundle with normal widget initialization and same-vendor lazy imports. Scanner signals for environment variables and dynamic imports do not form a concrete malicious chain.
Evidence
package.jsonsrc/index.tssrc/util/configCreator.tssrc/util/widgetFactory.tssrc/util/captcha/captchaRenderer.tsxsrc/util/captcha/components/bundleCaptcha.tsxdist/index.js
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Manifest has no preinstall, install, or postinstall hook.
- Runtime dynamic imports load declared Prosopo captcha dependencies for detector prefetch.
- Environment values are used only to construct captcha configuration.
Evidence against
- No child-process, shell, eval/vm, credential harvesting, filesystem mutation, or direct network client was found in shipped source.
- The flagged dynamic imports are package-aligned lazy loading for the widget.
Behavioral surface
CryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
4package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L4: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L5: import { getWindowCallback } from "@prosopo/procaptcha-common";
L6: import { at } from "@prosopo/util";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L4package.jsonView file
26"scripts": {
"clean": "del-cli --verbose dist tsconfig.tsbuildinfo",
"build": "npm run build:cross-env -- --mode ${NODE_ENV:-development}",
"build:cross-env": "vite build --config vite.esm.config.ts",
"build:tsc": "tsc --build --verbose",
"build:cjs": "NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV",
"typecheck": "tsc --project tsconfig.types.json",
"bundle": "NODE_ENV=${NODE_ENV:-development}; vite build --config vite.config.ts --mode $NODE_ENV",
"bundle:iife": "NODE_ENV=${NODE_ENV:-development}; vite build --config vite.iife.config
Low
Suspicious Lifecycle Evidence
Manifest has no preinstall, install, or postinstall hook.
package.jsonFindings
1 High2 Medium7 Low
HighCopied Package Dependency Bridgedist/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencesrc/index.ts
LowAi Review Evidencesrc/util/configCreator.ts
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.1.49.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.1.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.