registry / @sojogg/sdk / 0.1.3
@sojogg/sdk@0.1.3
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no install hook or malicious behavior. Runtime network calls use the configured Sojo frame or explicit server helper calls, while X intents require a user gesture.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer calls init, or calls an exported client method.
Impact
No confirmed harmful effect; the reviewed behavior supports Sojo sign-in, events, and X intents.
Mechanism
The client mounts a frame at the configured origin and exchanges messages with that frame. Optional tracking sends a shortened referrer, and legacy sign-in data is sent only when explicitly supplied by the consumer.
AI rationale
Source inspection found no install hook or malicious behavior. Runtime network calls use the configured Sojo frame or explicit server helper calls, while X intents require a user gesture.
Network endpoints2
id.sojo.ggx.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports client and server modules and contains no install lifecycle script.
- The client does nothing on import; calling init creates the client.
- The browser client defaults to Sojo’s identity host; consumers can configure another origin.
- A legacy token is sent only when the consumer supplies that option, and the frame message targets the configured origin.
- Default load tracking can be disabled, and its referrer is shortened before being sent through the frame.
- X intent helpers check for a user gesture before opening an intent.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
10 flaggeddist/core.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgdist/core.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @sojogg/sdk@0.1.2
matchedIdentity = npm:QHNvam9nZy9zZGs:0.1.2
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkg467self._post({ t: "hello", v: SDK_VERSION, lid: self._lid, surface: surfaceHint(), legacy: L && typeof t === "string" && t ? { provider: L.provider, token: t } : undefined });
self._said = true;
self._pill();
});
}
/** Tells the frame where the pill sits (or that it's hidden)
Findings
2 High1 Medium9 Low
HighSemantic Analysis Limiteddist/core.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/core.js
MediumNetwork
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/client.js
LowAi Review Evidencedist/client.js
LowAi Review Evidencedist/client.js
LowAi Review Evidencedist/client.js
LowAi Review Evidencedist/core.js
LowAi Review Evidencedist/core.js
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.3.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.