registry / Data exfiltration / @sphoro/bugcatch-web-sdk / 0.14.0

@sphoro/bugcatch-web-sdk@0.14.0

Drop-in browser SDK — report bugs with console, network and environment context, without the extension.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package is a functional browser bug-reporting SDK with broad but purpose-aligned diagnostic collection. Because source parsing coverage was incomplete and the SDK can transmit collected telemetry, a warning is safer than a clean verdict.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A host application calls init and a user or integration submits a bug report.

Impact

Console output, request metadata, page URL, environment details, and supplied report content can be transmitted to the configured service.

Mechanism

Global browser diagnostic capture followed by a report POST to the configured API base.

AI rationale

Evidence

src/collectors.jssrc/index.jssrc/references.jsdist/bugcatch.umd.js

Network endpoints1

localhost:3000

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

After explicit initialization, the SDK globally intercepts console, fetch, and XHR activity; all three captures are enabled by default.
Submitting a report sends browser environment data plus buffered console and network records to the configured API endpoint.
The shipped browser bundle contains a BugCatch-branded external link, and the source fetches project-provided reference-field configuration.
The manifest has no registry install hook; its only lifecycle script is prepublishOnly.

Evidence against

No child-process, shell, eval, dynamic code loading, filesystem access, or install-time execution was found.
Network capture records metadata rather than request bodies and applies redaction before buffering.
Screen and microphone capture use browser permission-gated media APIs.

Behavioral surface

Source

NetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/bugcatch.umd.jsView file

1(function(H,te){typeof exports=="object"&&typeof module<"u"?module.exports=te():typeof define=="function"&&define.amd?define(te):(H=typeof globalThis<"u"?globalThis:H||self,H.BugCa... L2:

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/bugcatch.umd.jsView on unpkg · L1

826<a class="brand-credit" href="https://bugcatch.sphoro.com" target="_blank" rel="noopener noreferrer" aria-label="BugCatch">${_o}</a>

Medium

Ai Review Evidence

The shipped browser bundle contains a BugCatch-branded external link, and the source fetches project-provided reference-field configuration.

dist/bugcatch.umd.jsView on unpkg · L826

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

Findings

3 High5 Medium4 Low

HighBrowser Session Account Hijackdist/bugcatch.umd.js

HighSemantic Analysis Limitedpackage.json

HighPrevious Version Dangerous Deltasrc/references.js

MediumNetwork

MediumAi Review Evidencesrc/collectors.js

MediumAi Review Evidencesrc/index.js

MediumAi Review Evidencesrc/references.js

MediumAi Review Evidencedist/bugcatch.umd.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sphoro/bugcatch-web-sdk@0.14.0.

See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.

Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.14.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 08:45:10.530Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Data exfiltration / @sphoro/bugcatch-web-sdk / 0.14.0

@sphoro/bugcatch-web-sdk@0.14.0

Drop-in browser SDK — report bugs with console, network and environment context, without the extension.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A host application calls init and a user or integration submits a bug report.

Impact

Console output, request metadata, page URL, environment details, and supplied report content can be transmitted to the configured service.

Mechanism

Global browser diagnostic capture followed by a report POST to the configured API base.

AI rationale

Evidence

src/collectors.jssrc/index.jssrc/references.jsdist/bugcatch.umd.js

Network endpoints1

localhost:3000

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

After explicit initialization, the SDK globally intercepts console, fetch, and XHR activity; all three captures are enabled by default.
Submitting a report sends browser environment data plus buffered console and network records to the configured API endpoint.
The shipped browser bundle contains a BugCatch-branded external link, and the source fetches project-provided reference-field configuration.
The manifest has no registry install hook; its only lifecycle script is prepublishOnly.

Evidence against

No child-process, shell, eval, dynamic code loading, filesystem access, or install-time execution was found.
Network capture records metadata rather than request bodies and applies redaction before buffering.
Screen and microphone capture use browser permission-gated media APIs.

Behavioral surface

Source

NetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/bugcatch.umd.jsView file

1(function(H,te){typeof exports=="object"&&typeof module<"u"?module.exports=te():typeof define=="function"&&define.amd?define(te):(H=typeof globalThis<"u"?globalThis:H||self,H.BugCa... L2:

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/bugcatch.umd.jsView on unpkg · L1

826<a class="brand-credit" href="https://bugcatch.sphoro.com" target="_blank" rel="noopener noreferrer" aria-label="BugCatch">${_o}</a>

Medium

Ai Review Evidence

The shipped browser bundle contains a BugCatch-branded external link, and the source fetches project-provided reference-field configuration.

dist/bugcatch.umd.jsView on unpkg · L826

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

Findings

3 High5 Medium4 Low

HighBrowser Session Account Hijackdist/bugcatch.umd.js

HighSemantic Analysis Limitedpackage.json

HighPrevious Version Dangerous Deltasrc/references.js

MediumNetwork

MediumAi Review Evidencesrc/collectors.js

MediumAi Review Evidencesrc/index.js

MediumAi Review Evidencesrc/references.js

MediumAi Review Evidencedist/bugcatch.umd.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sphoro/bugcatch-web-sdk@0.14.0.

See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.

Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.14.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 08:45:10.530Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface