registry / @prosopo/procaptcha-bundle / 4.5.15
@prosopo/procaptcha-bundle@4.5.15
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe inspected manifest and runtime entrypoint show widget setup and guarded provider prefetch, with no concrete attack behavior identified. The environment setting is passed to the provider prefetch path, while the manifest has no install lifecycle hook.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading the bundle runs startup; detector prefetch occurs when a widget has a site key and its start mode is not manual.
Impact
No confirmed credential transfer, unrelated account action, or install-time mutation was established.
Mechanism
The bundle reads widget parameters and dynamically loads provider modules for detector prefetch.
AI rationale
The inspected manifest and runtime entrypoint show widget setup and guarded provider prefetch, with no concrete attack behavior identified. The environment setting is passed to the provider prefetch path, while the manifest has no install lifecycle hook.
Evidence
package.jsondist/index.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the package entrypoints to the inspected ESM and CommonJS bundles and lists build scripts; no install lifecycle hook was found.
- The detector prefetch requires a site key and skips manual start mode before loading provider modules.
- Bundle startup sets up implicit rendering according to script parameters and document readiness; the exported API provides widget operations.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
6package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L6: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L7: import { getWindowCallback } from "@prosopo/procaptcha-common";
L8: import { PROCAPTCHA_START_EVENT, StartModeEnum } from "@prosopo/types";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L641if (!siteKey) return;
if (flags.startMode === StartModeEnum.manual) return;
Promise.all([import("@prosopo/procaptcha-frictionless"), import("@prosopo/procaptcha-common")]).then((
Low
Ai Review Evidence
The detector prefetch requires a site key and skips manual start mode before loading provider modules.
dist/index.jsView on unpkg · L41223var boot = () => {
const { onloadUrlCallback, renderExplicit } = extractParams(BUNDLE_NAMES);
let readyCalled = false;
if (renderExplicit !== "explicit") {
getProcaptchaScript
Low
Ai Review Evidence
Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgedist/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.5.15.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.5.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.