@prosopo/procaptcha-bundle@4.5.16
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package manifest has no install lifecycle hook, and the inspected entrypoints and required runtime helpers support CAPTCHA widget behavior. The dependency bridge and environment references are consistent with the declared widget and build configuration, with no concrete attack behavior found.
Decision evidence
public snapshot- The manifest points to the widget entrypoints and contains build, serve, and test scripts; no install lifecycle hook is present. Its repository path matches this package.
- The runtime entry initializes and mounts CAPTCHA widgets, while its helpers use caller-provided session, configuration, and timeout values.
- The inspected declared dependencies expose environment loading, language handling, form cleanup, and CAPTCHA provider functions consistent with the widget runtime; no attack behavior was identified in the required source paths.
Source & flagged code
6 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/index.jsView on unpkg · L6The runtime entry initializes and mounts CAPTCHA widgets, while its helpers use caller-provided session, configuration, and timeout values.
dist/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.5.16.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.5.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.