@sojogg/sdk@0.1.10
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install hooks, and importing the browser entry point performs no setup; the caller must initialize the client. Its default load event is documented and can be disabled, and the observed network behavior supports the SDK's stated Sojo integration purpose.
Decision evidence
public snapshot- The manifest exports browser and server SDK entry points and defines no lifecycle scripts.
- The browser entry point says import does nothing; client setup begins when the caller invokes init().
- The types document the automatic load event and provide track: false to disable it.
- The load event includes a referrer truncated to 120 characters and is sent through the Sojo frame.
- The browser client uses the configured Sojo origin for its frame and postMessage transport.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.10.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.