registry / @prosopo/procaptcha-frictionless / 2.13.19

@prosopo/procaptcha-frictionless@2.13.19

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Importing and using the captcha component can fetch and execute a detector module provided by the selected captcha provider. No malicious package-controlled attack chain was confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

A host page mounts the captcha component and starts bot detection.

Impact

The selected provider can supply detector code that runs in the host browser context as part of captcha operation.

Mechanism

Provider-served detector loading and captcha API requests.

AI rationale

The remote detector execution is an explicit, runtime captcha feature and is activated through normal component use, not installation. No exfiltration of local secrets, persistence, destructive action, or install-time mutation was found.

Evidence

package.jsonsrc/customDetectBot.tssrc/detectorLoader.tssrc/detectorPrefetch.tssrc/ProcaptchaFrictionless.tsx

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The runtime dynamically imports an obfuscated detector script supplied by a selected captcha provider.

@prosopo/procaptcha-frictionless@2.13.19

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code