registry / @prosopo/procaptcha-react / 2.14.8
@prosopo/procaptcha-react@2.14.8
⚠ Under reviewAI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected provider.one references are in test fixtures, and the environment read examined is used for development attributes. I cannot mark this clean because the active widget calls an unresolved runtime dependency, and other imported runtime dependency sources were also unavailable in this snapshot.
Static reason
No blocking static signals were detected.
Trigger
Importing the package and mounting its widget invokes the challenge manager.
Impact
No concrete harmful effect was established, but the unresolved manager behavior prevents a clean determination.
Mechanism
The widget passes its configuration, state, callbacks, and challenge data to the manager provided by @prosopo/procaptcha.
AI rationale
The inspected provider.one references are in test fixtures, and the environment read examined is used for development attributes. I cannot mark this clean because the active widget calls an unresolved runtime dependency, and other imported runtime dependency sources were also unavailable in this snapshot.
Evidence
package.jsondist/index.jsdist/components/procaptchaWidget.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest pins runtime dependencies including @prosopo/procaptcha.
- The widget calls Manager from @prosopo/procaptcha when mounted; that dependency’s source was unresolved in this snapshot.
- The collector passes browser interaction events to the supplied callback only when an account is present.
- The provider.one host appears in a test harness fixture.
- The inspected environment read controls development data attributes.
Evidence against
- The active widget delegates challenge handling to a runtime dependency whose source could not be inspected, leaving its behavior unresolved.
Behavioral surface
EnvironmentVars
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
22sions, not dead"
],
"dependencies": {
"@prosopo/common": "3.3.0",
"@prosopo/locale": "3.12.1",
"@prosopo/procaptcha": "2.11.34",
"@prosopo/procaptcha-common": "2.21.7",
"@prosopo/types": "5.17.1",
"@prosopo/util": "3.3.16"
Low
Suspicious Dependency Evidence
The manifest pins runtime dependencies including @prosopo/procaptcha.
package.jsonView on unpkg · L22dist/components/procaptchaWidget.jsView file
1import "../_virtual/_rolldown/runtime.js";
import { mountModal } from "./modal.js";
import { mountCaptchaComponent } from "./captchaComponent.js";
import { Teardown, activationOf, audioAlternativeOffer, createElement, createProcaptchaState, createRenderScheduler, isEventTrusted, mountCheckbox, mountHoneypot, mountTestModeBanner } from "@prosopo/procaptcha-common";
import { darkTheme, lightTheme } from "@prosopo/widget-skeleton";
import { Manager } from "@prosopo/procaptcha";
import { createTrans
Low
Suspicious Dependency Evidence
The widget calls Manager from @prosopo/procaptcha when mounted; that dependency’s source was unresolved in this snapshot.
dist/components/procaptchaWidget.jsFindings
1 Medium9 Low
MediumEnvironment Vars
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencedist/components/procaptchaWidget.js
LowSuspicious Dependency Evidencedist/components/procaptchaWidget.js
LowAi Review Evidencedist/components/collector.js
LowAi Review Evidencedist/tests/harness.js
LowAi Review Evidencedist/util/index.js
Affected versions and remediation
This report applies to @prosopo/procaptcha-react@2.14.8.
See all versions of @prosopo/procaptcha-react for other recorded verdicts.
- Review the evidence and your use of @prosopo/procaptcha-react@2.14.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.