@sphoro/bugcatch-web-sdk@0.14.2
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no install-time execution or malicious behavior. The browser requests and local storage use are consistent with the package's reporting functionality.
Decision evidence
public snapshot- The package has no install lifecycle hook; its only publish hook builds the distribution.
- The report request uses the host-configured API base.
- Watch tokens are read from this SDK's local storage key and sent to the configured API base.
- Captured network URLs are redacted before buffering.
- The UMD browser bundle contains the same configured watch-report request.
Source & flagged code
7 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch.umd.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/updates.js#virtual:normalized:round1View on unpkgFindings
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.14.2.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.14.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.