registry / @prosopo/procaptcha-frictionless / 2.13.20

@prosopo/procaptcha-frictionless@2.13.20

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

At widget runtime, a selected provider can supply an obfuscated JavaScript detector that this package executes. No install-time or local-system attack surface was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer mounts ProcaptchaFrictionless with a valid configuration.

Impact

The provider controls code that runs in the embedding page's browser context.

Mechanism

Provider-supplied blob module dynamic import.

AI rationale

The package contains a runtime remote-code execution path through an obfuscated provider-served detector. That is unresolved and security-relevant, but static inspection does not establish malicious intent or concrete harmful behavior by this release.

Evidence

package.jsonsrc/detectorLoader.tssrc/customDetectBot.tssrc/ProcaptchaFrictionless.tsx

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The widget accepts a provider response containing detectorScript and evaluates it as a JavaScript module from a blob URL.

@prosopo/procaptcha-frictionless@2.13.20

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code