@prosopo/procaptcha-react@2.14.16
AI Security Review
scanned 5d ago · by lpm-firewall-aiA transitive dependency documents and implements sampled runtime telemetry that reports the page hostname and site key to Prosopo for self-hosted widgets. Because the package README says it collects zero data and does not disclose this beacon, classify it as suspicious telemetry rather than malicious exfiltration.
Static reason
No blocking static signals were detected.
Trigger
Rendering a self-hosted widget, as described in the dependency changelog; the beacon runs on about one render in a thousand when the site key and provider-list override are present.
Impact
Prosopo can identify self-hosted installs and their versions. The package README's zero-data claim does not disclose this telemetry, creating a user disclosure concern.
Mechanism
Sends a GET request to beacon.prosopo.io with the page hostname, site key, bundle version and sample rate. It omits credentials and the referrer; a build-time setting disables it.
AI rationale
A transitive dependency documents and implements sampled runtime telemetry that reports the page hostname and site key to Prosopo for self-hosted widgets. Because the package README says it collects zero data and does not disclose this beacon, classify it as suspicious telemetry rather than malicious exfiltration.
Evidence
.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/dist/esm/usageBeacon.js.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/CHANGELOG.mdREADME.md
Network endpoints1
beacon.prosopo.io/v1/b.gif
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The transitive dependency defines a beacon URL containing the page hostname, site key, bundle version and sample rate.
- The beacon is sent as a GET request to beacon.prosopo.io with credentials and referrer omitted.
- The dependency changelog says self-hosted widgets send the beacon on about one render in a thousand; the package README says Procaptcha collects zero data.
Evidence against
- The beacon is limited to self-hosted builds and requires a site key and provider-list override.
- The beacon is sampled at 0.1% and can be disabled at build time with PROSOPO_USAGE_BEACON=false.
- The package manifest has no install lifecycle scripts. Its runtime entry exports widget components.
Behavioral surface
EnvironmentVars
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/dist/esm/usageBeacon.jsView file
19r usageBeaconUrl = (host, siteKey, version, sampleRate) => `${USAGE_BEACON_URL}?${new URLSearchParams({
host,
sitekey: siteKey,
v: version,
p: String(sampleRate)
})}`;
var fetchBeacon =
Medium
Suspicious Dependency Evidence
The transitive dependency defines a beacon URL containing the page hostname, site key, bundle version and sample rate.
.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/dist/esm/usageBeacon.jsView on unpkg · L1925(url) => {
fetch(url, {
mode: "no-cors",
credentials: "omit",
keepalive: true,
referrerPolicy: "no-referrer"
}).catch(() => void 0);
};
/**
* Tells Prosopo that a self-h
Medium
Ai Review Evidence
The beacon is sent as a GET request to beacon.prosopo.io with credentials and referrer omitted.
.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/dist/esm/usageBeacon.jsView on unpkg · L25Findings
5 Medium3 Low
MediumEnvironment Vars
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/dist/esm/usageBeacon.js
MediumAi Review Evidence.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/dist/esm/usageBeacon.js
MediumSuspicious Dependency Evidence.lpm-dependency-evidence-517c56d3-ba9a-486c-9eb1-5f090ec6acea/3/npm-linux/CHANGELOG.md
MediumSuspicious Dependency EvidenceREADME.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @prosopo/procaptcha-react@2.14.16.
See all versions of @prosopo/procaptcha-react for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-react@2.14.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.