@sojogg/sdk@0.1.2
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest declares no install lifecycle hook, and the inspected runtime behavior is consistent with a game SDK communicating with its configured Sojo service. Network and event APIs are package-aligned or explicitly invoked, with no concrete attack behavior found.
Decision evidence
public snapshot- package.json exports browser and server entrypoints and declares no lifecycle hook.
- The browser client creates a frame at the configured Sojo origin and sends messages to that origin.
- The client accepts frame messages only from its own frame at the configured origin.
- Load tracking is optional, can be disabled, and queues event data for the frame.
- Token retrieval is an explicit API call intended to provide a game token to the caller's server.
- Legacy-token forwarding requires caller-supplied legacy configuration and is documented for first-party migration.
Source & flagged code
10 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.2.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.