registry / @sphoro/bugcatch-web-sdk / 0.14.3
@sphoro/bugcatch-web-sdk@0.14.3
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle execution, shell execution, dynamic code loading, persistence, or hidden endpoint. The token handling and reporting behavior are package-aligned browser SDK functions.
Static reason
No blocking static signals were detected.
Trigger
No automatic install hook or import-time attack was identified; normal behavior begins when the host initializes or uses the SDK.
Impact
No attack impact was identified; normal operation can submit user-created diagnostic reports to the configured API.
Mechanism
No malicious mechanism was found; update calls use a stored report token with configured API routes.
AI rationale
Static inspection found no lifecycle execution, shell execution, dynamic code loading, persistence, or hidden endpoint. The token handling and reporting behavior are package-aligned browser SDK functions.
Network endpoints1
localhost:3000
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest contains build and prepublish scripts only; it has no install lifecycle hook.
- The browser bundle is a standard UMD wrapper that exposes BugCatch.
- Update requests read a package-specific local token and send it only to the configured API path.
- Network and error capture are enabled through explicit initialization options.
Evidence against
- The SDK can capture browser diagnostic data and submit reports to the configured API when the host uses it.
Behavioral surface
NetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/bugcatch.umd.jsView file
1(function(q,te){typeof exports=="object"&&typeof module<"u"?module.exports=te():typeof define=="function"&&define.amd?define(te):(q=typeof globalThis<"u"?globalThis:q||self,q.BugCa...
L2:
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch.umd.jsView on unpkg · L11(function(q,te){typeof exports=="object"&&typeof module<"u"?module.exports=te():typeof define=="function"&&define.amd?define(te):(q=typeof globalThis<"u"?globalThis:q||self,q.BugCatch=te())})(this,function(){"use strict";
Low
Ai Review Evidence
The browser bundle is a standard UMD wrapper that exposes BugCatch.
dist/bugcatch.umd.jsView on unpkg · L1src/updates.js#virtual:normalized:round1View file
•
Findings
2 High1 Medium9 Low
HighBrowser Session Account Hijackdist/bugcatch.umd.js
HighSemantic Analysis Limitedsrc/updates.js#virtual:normalized:round1
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/bugcatch.umd.js
LowAi Review Evidencesrc/updates.js
LowAi Review Evidencesrc/index.js
LowAi Review Evidencesrc/index.js
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.14.3.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.14.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.