registry / @prosopo/procaptcha-bundle / 4.5.21
@prosopo/procaptcha-bundle@4.5.21
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package’s metadata and runtime entry points match a browser CAPTCHA bundle: import-time behavior initializes widget integration, and prefetch is tied to a supplied site key. The scanner’s runtime-bridge and environment-variable flags correspond to a `node:module` import and Prosopo configuration reads; I found no unrelated credential flow or install-time behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the browser entry initializes the widget API and page boot logic; detector prefetch occurs for configured widgets with a site key unless start mode is manual.
Impact
Expected CAPTCHA rendering and provider requests; no malicious impact identified.
Mechanism
The entry mounts or prepares CAPTCHA widgets and passes widget configuration to Prosopo dependencies. The inspected package source showed no credential collection, install-time contact or filesystem writes.
AI rationale
The package’s metadata and runtime entry points match a browser CAPTCHA bundle: import-time behavior initializes widget integration, and prefetch is tied to a supplied site key. The scanner’s runtime-bridge and environment-variable flags correspond to a `node:module` import and Prosopo configuration reads; I found no unrelated credential flow or install-time behavior.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package exports CAPTCHA widget entry points; its declared scripts are for building, serving and testing, with no install lifecycle hooks or bin entry.
- Import setup publishes the widget API and ready event, then boots the CAPTCHA page integration.
- Detector prefetch requires a site key and is skipped in manual start mode; it passes the widget’s site key, language and integration to Prosopo dependencies.
- Environment reads configure Prosopo environment, site key, server URL and events URI; I found no code that searches for user credentials or sends them elsewhere.
- The flagged virtual runtime bridge contains only an import of node:module.
Evidence against
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/esm/index.jsView file
7package = @prosopo/procaptcha-bundle; repositoryIdentity = captcha; dependency = @prosopo/procaptcha-common
L7: import { WidgetThemeResolver } from "./util/widgetThemeResolver.js";
L8: import { getWindowCallback } from "@prosopo/procaptcha-common";
L9: import { PROCAPTCHA_START_EVENT, StartModeEnum } from "@prosopo/types";
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/esm/index.jsView on unpkg · L7304ocaptchaWidgets.keys()) : [widgetId];
for (const id of ids) {
const entry = procaptchaWidgets.get(id);
if (!entry) continue;
entry.unbindTrigger?.();
entry.handle.destroy();
clearHost(entry);
procaptchaWidgets.delete(id);
}
};
window.procaptcha = {
ready,
render,
reset,
remove,
execute,
start
};
var procaptchaReadyEvent = new CustomEvent(PROCAPTCHA_READY_EVENT, {
detail: { timestamp: Date.now() },
bubbles: true,
cancelable: false
});
document.dispatchEvent(procaptchaReadyEvent);
boot();
//#endregion
export { ready as default, execute, remove, render, reset, sta
Low
Ai Review Evidence
Import setup publishes the widget API and ready event, then boots the CAPTCHA page integration.
dist/esm/index.jsView on unpkg · L304Findings
1 High2 Medium9 Low
HighCopied Package Dependency Bridgedist/esm/index.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/esm/index.js
LowSuspicious Dependency Evidencedist/esm/index.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-bundle@4.5.21.
See all versions of @prosopo/procaptcha-bundle for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-bundle@4.5.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.