@sojogg/sdk@0.1.6
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected runtime routes frame communication through the configured Sojo origin with origin checks. The account operations are caller-invoked SDK features, and the inspected telemetry and ad requests are directed through that same configured service.
Decision evidence
public snapshot- package.json exports the browser and server entrypoints and declares no lifecycle scripts.
- dist/core.js creates a frame on the configured Sojo origin; messages are accepted only from that frame and origin.
- Sign-in and purchase actions are sent when the game calls the corresponding SDK methods.
- Load tracking is routed through the Sojo frame, and ad requests use the configured Sojo base URL.
Source & flagged code
8 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.6.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.