registry / @prosopo/procaptcha-frictionless / 2.13.18

@prosopo/procaptcha-frictionless@2.13.18

⚠ Under review

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 143 KB of source, external domains: pronode.example, provider.test, staging-pronode3.prosopo.io

Source & flagged code

3 flagged

dist/detectorLoader.jsView file

Lines 1-21javascript

1//#region src/detectorLoader.ts

2/**

3* Loads a detector from a provider-served obfuscated ESM string (the per-session

4* pool bundle). Evaluated via a blob URL — the served module is self-contained

5* (no imports), so dynamic `import()` of the blob yields its default export.

6*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/detectorLoader.jsView on unpkg · L4

7var DetectorLoaderFromScript = async (script) => {

8 const blob = new Blob([script], { type: "text/javascript" });

9 const url = URL.createObjectURL(blob);

10 try {

11 return (await import(

12 /* @vite-ignore */

13 url

14)).default;

15 } finally {

16 URL.revokeObjectURL(url);

17 }

18};

19//#endregion

20export { DetectorLoaderFromScript };

dist/cjs/customDetectBot.cjsView file

Lines 1-23javascript

1const require_detectorLoader = require("./detectorLoader.cjs");

2const require_detectorPrefetch = require("./detectorPrefetch.cjs");

3let _prosopo_procaptcha_common = require

src/customDetectBot.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/customDetectBot.ts#virtual:normalized:round1View on unpkg

Source & flagged code

3 flagged · loading source

dist/detectorLoader.jsView file

4* pool bundle). Evaluated via a blob URL — the served module is self-contained L5: * (no imports), so dynamic `import()` of the blob yields its default export. L6: */

@prosopo/procaptcha-frictionless@2.13.18

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code