@sphoro/bugcatch-web-sdk@0.15.0
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found package-aligned diagnostic capture and reporting, with no lifecycle hook or concrete malicious behavior. The bundled browser artifact is consistent with the inspected source.
Decision evidence
public snapshot- Package metadata has no install lifecycle hook; its scripts are build, development, and prepublish only.
- Browser capture hooks are installed only during the host application's init call.
- Sending a bug report requires initialization and posts the assembled payload to the configured API base.
- Stored report-watch tokens are used only for the configured report API and are not sent when absent.
- Captured network URLs are redacted before buffering.
- The distributed browser bundle uses a localhost default API base.
Source & flagged code
7 flaggedBrowser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch.umd.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/updates.js#virtual:normalized:round1View on unpkgFindings
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.15.0.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.