registry / @prosopo/procaptcha-bundle / 4.2.4
@prosopo/procaptcha-bundle@4.2.4
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection found no lifecycle installation hook, self-dependency, file or credential harvesting, shell execution, persistence, or direct exfiltration. The flagged environment-variable and dynamic-import use is aligned with initializing a browser captcha widget.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the browser entry or rendering a captcha widget.
Impact
It modifies only captcha-related DOM state in the host page; no package code harvests credentials, writes files, executes shells, or installs persistence.
Mechanism
Browser captcha widget initialization and provider prefetch.
AI rationale
Source inspection found no lifecycle installation hook, self-dependency, file or credential harvesting, shell execution, persistence, or direct exfiltration. The flagged environment-variable and dynamic-import use is aligned with initializing a browser captcha widget.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines development and build commands, with no automatic install lifecycle hook.
- The built entry dynamically loads declared captcha-provider dependencies only when a site key is supplied.
Evidence against
- The entry runs browser DOM initialization on import and invokes a provider prefetch during widget rendering.
- Environment selection is passed to the provider dependency, so its network behavior is outside this bundle's direct implementation.
Behavioral surface
CryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/index.jsView file
4package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L4: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L5: import { getWindowCallback } from "@prosopo/procaptcha-common";
L6: import { at } from "@prosopo/util";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L435var startDetectorPrefetch = (siteKey, flags) => {
if (!siteKey) return;
Promise.all([import("@prosopo/procaptcha-frictionless"), import("@prosopo/procaptcha-common")]).then(([frictionless, common]) => {
frictionless.prefetchDetector(process.env.PROSOPO_DEFAULT_ENVIRONMENT, common.pickIpMode(flags), siteKey);
}).catch(() => void 0);
};
Low
Suspicious Dependency Evidence
The built entry dynamically loads declared captcha-provider dependencies only when a site key is supplied.
dist/index.jsView on unpkg · L35package.jsonView file
Findings
1 High2 Medium6 Low
HighCopied Package Dependency Bridgedist/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencedist/index.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.2.4.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.2.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.