registry / @prosopo/procaptcha-react
@prosopo/procaptcha-react
This report shows the evidence for @prosopo/procaptcha-react@2.14.21. 0 of 54 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 11h ago · by lpm-firewall-aiThe package has no install hooks, and its entry point only exposes widget functions. Network activity is part of CAPTCHA verification and begins through widget activation or an explicit caller option.
Static reason
No blocking static signals were detected.
Trigger
A widget activation, an explicit procaptcha:execute event, or caller-supplied autoStart option.
Impact
No malicious behavior identified; the observed data flow supports the CAPTCHA verification feature.
Mechanism
The manager requests a challenge from a selected provider and submits the CAPTCHA solution with CAPTCHA-related behavioral signals and client metadata.
AI rationale
The package has no install hooks, and its entry point only exposes widget functions. Network activity is part of CAPTCHA verification and begins through widget activation or an explicit caller option.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exports CAPTCHA widget mounting functions and declares no install lifecycle scripts.
- The entry point imports component modules and exports their functions; it does not invoke them at import time.
- Challenge startup follows widget activation or an explicit caller option such as autoStart.
- On submission, the CAPTCHA manager sends challenge data and CAPTCHA-related behavioral signals through the provider API.
Evidence against
Behavioral surface
EnvironmentVars
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
6"main": "dist/esm/index.js",
"type": "module",
"sideEffects": false,
"engines": {
"node": "^24"
},
"exports": {
".": {
"import": "./dist/esm/index.js",
Low
Suspicious Lifecycle Evidence
The package exports CAPTCHA widget mounting functions and declares no install lifecycle scripts.
package.jsonView on unpkg · L660"scripts": {
"clean": "del-cli --verbose dist",
"build:esm": "vite build --config vite.esm.config.ts --mode ${NODE_ENV:-development}",
"build:tsc": "tsc --build --verbose",
"build:cjs": "NODE_ENV=${NODE_ENV:-development}; vite build
Low
Suspicious Lifecycle Evidence
The package exports CAPTCHA widget mounting functions and declares no install lifecycle scripts.
package.jsonView on unpkg · L60dist/esm/index.jsView file
1import "./_virtual/_rolldown/runtime.js";
import { mountButton } from "./components/button.js";
import { mountModal } from "./components/modal.js";
import { mountCaptchaWidget } from "./components/captchaWidget.js";
import { mountCaptchaComponent } from "./components/captchaComponent.js";
import mountCollector from "./components/collector.js";
import mountPr
Findings
1 Medium11 Low
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/esm/index.js
LowAi Review Evidencedist/esm/components/procaptchaWidget.js
LowAi Review Evidencedist/esm/components/procaptchaWidget.js
LowAi Review Evidence.lpm-dependency-evidence-2b3a2f21-c11e-4fd0-9b9f-c6813a067426/2/npm-linux/dist/esm/modules/Manager.js
LowAi Review Evidence.lpm-dependency-evidence-2b3a2f21-c11e-4fd0-9b9f-c6813a067426/2/npm-linux/dist/esm/modules/Manager.js
LowAi Review Evidence.lpm-dependency-evidence-2b3a2f21-c11e-4fd0-9b9f-c6813a067426/2/npm-linux/dist/esm/modules/Manager.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-react@2.14.21.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @prosopo/procaptcha-react@2.14.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.