@sojogg/sdk@0.1.15
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe client sends the referring page URL as part of default load telemetry, while the README only describes event tracking generally. This is a limited runtime disclosure concern rather than evidence of credential theft or unrelated collection.
Decision evidence
public snapshot- On client initialization, tracking is on by default and records a `load` event containing up to 120 characters of `document.referrer`; callers can disable it with `track: false.
- The queued event is sent to the Sojo frame through `postMessage`; the client’s configured frame origin is `https://id.sojo.gg`.
- The README mentions event tracking generally but does not disclose the automatic load event or its referrer field.
- The package has no lifecycle scripts, and its client entry point says import alone does not run the SDK.
- The telemetry goes to the package’s own Sojo service, consistent with the documented game SDK purpose.
- The automatic event has a `track: false` opt-out.
Source & flagged code
7 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.15.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.