registry / @prosopo/procaptcha-bundle / 4.5.19
@prosopo/procaptcha-bundle@4.5.19
⚠ Under reviewAI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected source shows normal language and widget setup, with no confirmed attack. The selected @prosopo/locale runtime dependency could not be inspected, so a clean verdict is not supported.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package entrypoint loads its language and widget modules.
Impact
The effect of that dependency on runtime behavior remains unverified.
Mechanism
Those modules use @prosopo/locale for language resolution and translation; the dependency source was unavailable for review.
AI rationale
The inspected source shows normal language and widget setup, with no confirmed attack. The selected @prosopo/locale runtime dependency could not be inspected, so a clean verdict is not supported.
Evidence
dist/esm/index.jsdist/esm/util/language.jsdist/esm/util/widgetFactory.js
Decision evidence
public snapshotAI called this Manual Review at 87.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares @prosopo/locale as a runtime dependency.
- The entrypoint imports language and widget modules that use @prosopo/locale for language resolution and translation.
- The source for this selected runtime dependency could not be inspected: its prepared package path was absent.
Evidence against
- The inspected entrypoint and locale call sites show language and widget setup; no attack behavior was established there.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/esm/index.jsView file
6package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L6: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L7: import { getWindowCallback } from "@prosopo/procaptcha-common";
L8: import { PROCAPTCHA_START_EVENT, StartModeEnum } from "@prosopo/types";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/esm/index.jsView on unpkg · L61import "./_virtual/_rolldown/runtime.js";
import { extractParams, getProcaptchaScript } from "./util/config.js";
import { siteLanguage } from "./util/language.js";
import { resolveStartMode } from "./util/startMode.js";
import { WidgetFactory } from "./util/widgetFactory.js";
import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
import { getWindowCallback } from "@prosopo/procaptcha-common";
import { PROCAP
Low
Ai Review Evidence
The entrypoint imports language and widget modules that use @prosopo/locale for language resolution and translation.
dist/esm/index.jsView on unpkg · L1package.jsonView file
Findings
1 High2 Medium8 Low
HighCopied Package Dependency Bridgedist/esm/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/esm/util/language.js
LowAi Review Evidencedist/esm/util/widgetFactory.js
LowAi Review Evidencedist/esm/index.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.5.19.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.5.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.