@sphoro/bugcatch-web-sdk@0.14.4
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe unrestricted destination combined with automatic forwarding of an existing credential is a conditional credential-exposure capability. There is no install-time execution or evidence of a package-controlled exfiltration endpoint.
Decision evidence
public snapshot- The client accepts caller-supplied options without restricting apiBase.
- A stored watch token is read from browser local storage and sent as a Bearer credential to apiBase.
- The published UMD browser bundle contains the same credentialed stream request.
- package.json has no install, preinstall, or postinstall lifecycle hook.
- The default API base is localhost; no package-controlled external recipient is hard-coded.
Source & flagged code
6 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch.umd.jsView on unpkg · L1The published UMD browser bundle contains the same credentialed stream request.
dist/bugcatch.umd.jsView on unpkg · L7Findings
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.14.4.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.14.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.