registry / @prosopo/procaptcha-frictionless / 2.13.22

@prosopo/procaptcha-frictionless@2.13.22

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The browser runtime downloads an opaque detector script from the selected captcha provider and evaluates it as a blob module. It also fetches a provider-supplied observation URL without credentials.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer renders and uses the frictionless captcha flow.

Impact

A compromised or malicious provider response can run arbitrary JavaScript in the embedding page's origin.

Mechanism

Provider-supplied script execution through dynamic blob import.

AI rationale

The package is not malicious at install time, but its normal runtime intentionally executes opaque provider-delivered JavaScript. That supply-chain and same-origin execution risk warrants a warning until the provider trust boundary is accepted.

Evidence

src/customDetectBot.tssrc/detectorLoader.tsdist/cjs/customDetectBot.cjs

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

During normal captcha use, the package obtains a provider-supplied detector script and passes it to a loader for execution.
The distributed CommonJS artifact contains the same provider-script execution path.

@prosopo/procaptcha-frictionless@2.13.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code