@sojogg/sdk@0.1.1
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe inspected source implements a browser and server SDK with explicit runtime entrypoints. The client’s frame messaging is origin-restricted, and its event tracking is part of the Sojo service integration; no concrete attack behavior was found.
Decision evidence
public snapshot- package.json maps the client and server exports to the package’s dist modules.
- dist/client.js exports init as the client creation point and defaults its origin to https://id.sojo.gg.
- dist/core.js mounts a game-specific frame at BASE/frame and accepts messages only from that frame when the origin matches BASE.
- The SDK queues game events and sends them through the frame; its automatic load event includes a referrer capped at 120 characters.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.1.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.