registry / @prosopo/procaptcha-frictionless / 2.14.0

@prosopo/procaptcha-frictionless@2.14.0

AI Security Review

scanned 23d ago · by lpm-firewall-ai

When the frictionless CAPTCHA flow runs, provider-controlled JavaScript is fetched and executed in the embedding page. This is a remote-code-execution capability with access to inputs supplied by the widget.

Static reason

One or more suspicious static signals were detected.

Trigger

Mounting the widget in automatic mode, or starting it manually, activates the detector assignment flow.

Impact

A compromised or malicious provider can run arbitrary browser-side code in a site embedding this widget.

Mechanism

Provider-supplied script is dynamically imported from a Blob URL.

AI rationale

The source establishes runtime execution of opaque provider-delivered code in the host browser. That is an unresolved dangerous capability, although the inspected package does not establish a concrete malicious payload or install-time attack.

Evidence

src/customDetectBot.tssrc/detectorLoader.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package obtains a detector script from a selected provider at runtime.
It turns that provider-supplied string into a Blob module and dynamically imports it, executing remote code in the host browser.

@prosopo/procaptcha-frictionless@2.14.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code