@sojogg/sdk@0.1.4
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection found no lifecycle scripts or import-time attack behavior. Network and credential handling follows the SDK's Sojo integration, with legacy session data and server credentials supplied by the caller.
Decision evidence
public snapshot- The manifest exports client and server entry points.
- The client defaults to Sojo's identity origin.
- Legacy session handoff is available only through the caller-provided first-party legacy option, and the token is sent only when supplied.
- Client messages target the Sojo frame; replies are accepted only from that frame and origin.
- Server event calls use a supplied server key and default to Sojo's event endpoint.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.4.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.