registry / @prosopo/procaptcha-bundle / 4.2.5
@prosopo/procaptcha-bundle@4.2.5
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe inspected manifest has no install lifecycle hook, and the compiled entry's dynamic imports are declared same-vendor captcha dependencies. The static signals are consistent with normal browser captcha configuration and prefetching, not malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports the bundle or renders a Procaptcha widget.
Impact
No package-originated persistence, host modification, or secret exfiltration was identified.
Mechanism
Browser-side widget rendering and detector prefetch.
AI rationale
The inspected manifest has no install lifecycle hook, and the compiled entry's dynamic imports are declared same-vendor captcha dependencies. The static signals are consistent with normal browser captcha configuration and prefetching, not malicious behavior.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a browser bundle and contains no preinstall, install, or postinstall hook.
- The compiled entry only dynamically imports declared Prosopo captcha dependencies to prefetch detector resolution using a site key.
Evidence against
- No child-process, filesystem-write, credential-harvesting, or direct network-request primitive was found in the runtime source inspected.
- The environment references configure captcha settings rather than collecting or transmitting host secrets.
Behavioral surface
CryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/index.jsView file
4package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L4: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L5: import { getWindowCallback } from "@prosopo/procaptcha-common";
L6: import { at } from "@prosopo/util";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L435var startDetectorPrefetch = (siteKey, flags) => {
if (!siteKey) return;
Promise.all([import("@prosopo/procaptcha-frictionless"), import("@prosopo/procaptcha-common")]).then(([frictionless, common]) => {
frictionless.prefetchDetector(process.env.PROSOPO_DEFAULT_ENVIRONMENT, common.pickIpMode(flags), siteKey);
}).catch(() => void 0);
};
Low
Suspicious Dependency Evidence
The compiled entry only dynamically imports declared Prosopo captcha dependencies to prefetch detector resolution using a site key.
dist/index.jsView on unpkg · L35package.jsonView file
Findings
1 High2 Medium6 Low
HighCopied Package Dependency Bridgedist/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidencedist/index.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.2.5.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.2.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.