registry / @prosopo/procaptcha-frictionless / 2.13.13

@prosopo/procaptcha-frictionless@2.13.13

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

At widget runtime, a provider response can supply JavaScript that this package imports from a blob URL. The package does not validate or pin that script in its own source.

Static reason

One or more suspicious static signals were detected.

Trigger

Mounting and starting the ProcaptchaFrictionless React widget.

Impact

A compromised or malicious provider response could execute arbitrary code in the embedding page's origin.

Mechanism

provider-served script execution through Blob and dynamic import

AI rationale

No malicious install hook, persistence, local harvesting, or destructive behavior is present. However, executing an unpinned provider-supplied obfuscated script in the host page is a concrete unresolved remote-code-execution risk.

Evidence

dist/detectorLoader.jsdist/customDetectBot.jsdist/ProcaptchaFrictionless.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

Runtime accepts a provider-supplied obfuscated JavaScript string and executes it via blob dynamic import.

@prosopo/procaptcha-frictionless@2.13.13

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code