registry / @prosopo/procaptcha-frictionless / 2.13.23

@prosopo/procaptcha-frictionless@2.13.23

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A rendered frictionless captcha fetches an obfuscated detector from a dynamically selected provider and executes it in the browser. The fetched code is not present in the reviewed package.

Static reason

One or more suspicious static signals were detected.

Trigger

Starting the ProcaptchaFrictionless captcha flow.

Impact

A provider or response-path compromise can run arbitrary JavaScript with the embedding page's origin privileges.

Mechanism

Remote provider script loading through a Blob dynamic import.

AI rationale

The package deliberately executes opaque, provider-served JavaScript during normal browser use. That is a dangerous remote execution capability but does not by itself establish malicious package intent.

Evidence

src/customDetectBot.tssrc/detectorLoader.ts

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

It requests a detector script from a selected provider at runtime.
It converts that provider response into a Blob URL and dynamically imports it.
The detector is invoked during the captcha flow, giving provider-supplied code page-script execution.

@prosopo/procaptcha-frictionless@2.13.23

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code