@sojogg/sdk@0.1.9
Sojo: one account, every game. The browser client and the server helpers for games on Sojo.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically sends referrer data in its load event after init(), and the documentation does not disclose that payload detail. This is limited, opt-out runtime telemetry, so it warrants a warning rather than a block.
Decision evidence
public snapshot- By default, init() records a load event containing up to 120 characters of document.referrer; callers can disable the automatic event with track:false.
- The client sends its frame traffic to the configured Sojo origin, which defaults to https://id.sojo.gg.
- The README mentions event tracking and the types document that load tracking defaults on, but neither discloses that the load event includes the referrer.
- The README says importing the client runs nothing; the frame is mounted by an explicit init() call.
- package.json declares no lifecycle scripts or runtime dependencies.
- The referrer is bounded to 120 characters, and the automatic load event can be disabled with track:false.
Source & flagged code
6 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/core.js#virtual:normalized:round1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/core.jsView on unpkgFindings
Affected versions and remediation
This report applies to @sojogg/sdk@0.1.9.
See all versions of @sojogg/sdk for other recorded verdicts.
- Review the evidence and your use of @sojogg/sdk@0.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.