registry / @prosopo/procaptcha-frictionless / 2.18.2

@prosopo/procaptcha-frictionless@2.18.2

⚠ Under review

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 273 KB of source, external domains: example.test, p.one, pronode.example, provider.test, staging-pronode3.prosopo.io

Source & flagged code

3 flagged

dist/detectorLoader.jsView file

Lines 1-32javascript

1//#region src/detectorLoader.ts

2var blobAttempt = (script) => {

3 const url = URL.createObjectURL(new Blob([script], { type: "text/javascript" }));

4 return {

5 url,

6 release: () => URL.revokeObjectURL(url)

7 };

8};

9var dataAttempt = (script) => ({

10 url: `data:text/javascript;charset=utf-8,${encodeURIComponent(script)}`,

11 release: () => void 0

12});

13var defaultImporter = (url) => import(

14 /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/detectorLoader.jsView on unpkg · L12

15 /* webpackIgnore: true */

16 url

17);

18/**

19* Loads a detector from a provider-served obfuscated ESM string (the

20* per-session pool bundle). The module is self-contained, so a dynamic

21* `import()` yields its default export.

22*

23* A blob URL is tried first, then a `data:` URL. The two are gated by

24* different CSP directives and sites commonly allow one without the other — a

25* `script-src` of `*` matches neither, and a policy listing `data:` for

26* scripts and `blob:` only for workers blocks the blob path outright. Without

27* the fallback every session on such a site loses the detector, sends an empty

28* token, and can never pass frictionlessly.

29*

30* A blocked attempt logs a CSP violation before the import rejects. That noise

31* is the cost of recovering the session.

32*/

dist/cjs/authenticatedBadge.cjsView file

Lines 1-21javascript

1let _prosopo_procaptcha_common = require("@prosopo/procaptcha-common");

2let _prosopo_types = require("@prosopo/types");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cjs/authenticatedBadge.cjsView on unpkg · L1

3//#region src/authenticatedBadge.ts

src/customDetectBot.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/customDetectBot.ts#virtual:normalized:round1View on unpkg

Source & flagged code

3 flagged · loading source

dist/detectorLoader.jsView file

12}); L13: var defaultImporter = (url) => import( L14: /* @vite-ignore */

@prosopo/procaptcha-frictionless@2.18.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code