@sojogg/sdk
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
This report shows the evidence for @sojogg/sdk@0.1.16. 0 of 13 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install hooks, and its browser entry point states that importing it performs no setup. Its network and account-related features serve the documented game integration and are triggered by consumer calls or user intents.
Decision evidence
public snapshot- The package exposes browser and server SDK entry points and has no lifecycle scripts.
- The browser entry point documents that import does not run setup; initialization is explicit.
- Client token forwarding is to the Sojo frame, and server requests use Sojo endpoints with a caller-supplied server key.
- The SDK handles tokens and makes network requests, but the inspected flows serve its sign-in, verification, event, and game integration features.
- The package exposes X post, follow, like, and repost intents, which callers invoke explicitly.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.16.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @sojogg/sdk@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.