registry / @sojogg/sdk / 0.1.0
@sojogg/sdk@0.1.0
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no lifecycle hooks or import-time initialization. Runtime messaging is restricted to the SDK frame and its origin, and the observed tracking is first-party SDK behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the module and calls init; event tracking occurs during client initialization unless disabled.
Impact
No confirmed harmful impact; the reviewed behavior supports the SDK's game, identity, and analytics features.
Mechanism
The client communicates with its Sojo-origin frame and records a bounded referrer value in a load event.
AI rationale
Source inspection found no lifecycle hooks or import-time initialization. Runtime messaging is restricted to the SDK frame and its origin, and the observed tracking is first-party SDK behavior.
Evidence
package.jsondist/client.jsdist/core.js
Network endpoints1
id.sojo.gg
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the client and server modules and defines no lifecycle hooks.
- The client module imports without initializing the SDK; initialization is explicit.
- The client frame uses the configured Sojo origin, and incoming messages are accepted only from that frame and origin.
- Load tracking sends a bounded referrer value as an SDK event; this is package-aligned telemetry.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggeddist/core.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgpackage.jsonView file
1{
"name": "@sojogg/sdk",
"version": "0.1.0",
"description": "Sojo: one account, every game. The browser client and the server helpers for games on Sojo.",
"license": "MIT",
"homepage": "https://sojo.gg/agents.txt",
"type": "module",
"exports": {
"./client": {
"types": "./dist/client.d.ts",
"default": "./dist/client.js"
},
"./server": {
"types": "./dist/server.d.ts",
"default": "./dist/server.js"
Low
Suspicious Lifecycle Evidence
package.json exports the client and server modules and defines no lifecycle hooks.
package.jsonView on unpkg · L1Findings
1 High1 Medium5 Low
HighSemantic Analysis Limiteddist/core.js#virtual:normalized:round1
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/client.js
LowAi Review Evidencedist/core.js
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.0.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.