registry / @prosopo/procaptcha-frictionless / 2.15.0

@prosopo/procaptcha-frictionless@2.15.0

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Mounting the CAPTCHA can request a detector bundle from a selected provider and execute it in the browser. The executable payload is not present for static inspection or integrity verification.

Static reason

One or more suspicious static signals were detected.

Trigger

Rendering the frictionless CAPTCHA and receiving a provider detector bundle.

Impact

A compromised or malicious provider could execute arbitrary JavaScript in the embedding page's origin.

Mechanism

Remote JavaScript is loaded through a Blob URL and dynamic import.

AI rationale

The package is not conclusively malicious, but it creates a concrete provider-controlled browser code-execution surface. Its lack of install hooks and package-authored harvesting lowers the likelihood of direct package malware.

Evidence

src/detectorLoader.tssrc/customDetectBot.ts

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

It dynamically imports executable JavaScript supplied as a provider detector bundle.
The remotely supplied detector is automatically invoked during the frictionless flow.
The package deliberately accepts obfuscated per-session detector code, leaving its runtime behavior outside this package snapshot.

@prosopo/procaptcha-frictionless@2.15.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code