@sojogg/sdk@0.1.7
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package has no lifecycle hook, and importing the client does not initialize it. Runtime network behavior is tied to the configured identity frame; the inspected event tracking and caller-supplied legacy token path do not establish an attack.
Decision evidence
public snapshot- package.json exposes client and server modules and declares no lifecycle script.
- The browser client defaults to Sojo's identity origin and creates the frame only when init is called.
- The frame is loaded at the configured origin, and incoming messages must come from that frame and origin.
- Initialization queues a load event with a shortened referrer for delivery through the frame.
- Legacy credentials are forwarded only when the caller supplies a legacy token option.
Source & flagged code
9 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgpackage.json exposes client and server modules and declares no lifecycle script.
package.jsonView on unpkg · L7Findings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.7.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.