registry / @prosopo/procaptcha-frictionless / 2.19.0

@prosopo/procaptcha-frictionless@2.19.0

⚠ Under review

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 137 KB of source, external domains: agent.example, example.test, p.one, pronode.example, provider.one, provider.test, staging-pronode3.prosopo.io

Source & flagged code

2 flagged

dist/detectorLoader.jsView file

Lines 1-32javascript

1//#region src/detectorLoader.ts

2var blobAttempt = (script) => {

3 const url = URL.createObjectURL(new Blob([script], { type: "text/javascript" }));

4 return {

5 url,

6 release: () => URL.revokeObjectURL(url)

7 };

8};

9var dataAttempt = (script) => ({

10 url: `data:text/javascript;charset=utf-8,${encodeURIComponent(script)}`,

11 release: () => void 0

12});

13var defaultImporter = (url) => import(

14 /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/detectorLoader.jsView on unpkg · L12

15 /* webpackIgnore: true */

16 url

17);

18/**

19* Loads a detector from a provider-served obfuscated ESM string (the

20* per-session pool bundle). The module is self-contained, so a dynamic

21* `import()` yields its default export.

22*

23* A blob URL is tried first, then a `data:` URL. The two are gated by

24* different CSP directives and sites commonly allow one without the other — a

25* `script-src` of `*` matches neither, and a policy listing `data:` for

26* scripts and `blob:` only for workers blocks the blob path outright. Without

27* the fallback every session on such a site loses the detector, sends an empty

28* token, and can never pass frictionlessly.

29*

30* A blocked attempt logs a CSP violation before the import rejects. That noise

31* is the cost of recovering the session.

32*/

dist/cjs/customDetectBot.cjsView file

Lines 1-23javascript

1const require_detectorLoader = require("./detectorLoader.cjs");

2const require_detectorPrefetch = require("./detectorPrefetch.cjs");

3let _prosopo_procaptcha_common = require

Source & flagged code

2 flagged · loading source

dist/detectorLoader.jsView file

@prosopo/procaptcha-frictionless@2.19.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code