registry / @prosopo/procaptcha-bundle / 4.1.60
@prosopo/procaptcha-bundle@4.1.60
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe required manifest and bundle entrypoint are consistent with a browser CAPTCHA widget, and the inspected source shows no concrete malicious behavior. The scanner’s environment-variable and dependency-bridge signals do not establish an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Widget rendering with a site key triggers detector prefetch.
Impact
No confirmed attack surface was established.
Mechanism
The entrypoint imports Prosopo modules and passes them the site key and IP-mode flags.
AI rationale
The required manifest and bundle entrypoint are consistent with a browser CAPTCHA widget, and the inspected source shows no concrete malicious behavior. The scanner’s environment-variable and dependency-bridge signals do not establish an attack.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the package and dist/index.js as its main entrypoint; its scripts show build and test commands, with no install lifecycle hook.
- dist/index.js imports the bundle runtime and widget modules; its detector prefetch runs only when a site key is present.
- src/index.ts dynamically imports Prosopo detector modules and passes the site key and IP-mode flags to the package’s prefetch function.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
4package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L4: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L5: import { getWindowCallback } from "@prosopo/procaptcha-common";
L6: import { at } from "@prosopo/util";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L41import "./_virtual/_rolldown/runtime.js";
import { extractParams, getProcaptchaScript } from "./util/config.js";
import { WidgetFactory } from "./util/widgetFactory.js";
import { WidgetTheme
Low
Ai Review Evidence
dist/index.js imports the bundle runtime and widget modules; its detector prefetch runs only when a site key is present.
dist/index.jsView on unpkg · L135{
if (!siteKey) return;
Promise.all([import("@prosopo/procaptcha-frictionless"), import("@prosopo/procaptcha-common")]).then(([frictionless, common]) => {
frictionless.prefetchDetector(process.env.PROSOPO_DEFAULT_EN
Low
Ai Review Evidence
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgedist/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencesrc/index.ts
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.1.60.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.1.60 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.