registry / @prosopo/procaptcha-frictionless / 2.13.21

@prosopo/procaptcha-frictionless@2.13.21

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The browser widget fetches an opaque detector script from a provider and executes it as a Blob module. The provider can also supply a beacon URL for a credential-free GET request.

Static reason

One or more suspicious static signals were detected.

Trigger

A site renders and starts the default ProcaptchaFrictionless widget.

Impact

A compromised or malicious selected provider can run arbitrary JavaScript in the embedding page's browser origin.

Mechanism

Provider-supplied script is dynamically imported as a Blob module.

AI rationale

This is a concrete remote code execution capability in the browser, although it is activated only through the captcha flow and there is no install-time or host-system compromise behavior. The opaque provider-controlled payload warrants a warning rather than a malware block.

Evidence

src/ProcaptchaFrictionless.tsxsrc/customDetectBot.tssrc/detectorLoader.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The widget requests a per-session detector script from a selected provider.
It turns the received script into a Blob module and dynamically imports it, executing provider-controlled code in the browser.

@prosopo/procaptcha-frictionless@2.13.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code