@sphoro/bugcatch-web-sdk@0.18.0
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK sends runtime installation telemetry automatically on init and provides no evident way to turn it off. The data is limited to project and integration metadata sent to the configured BugCatch API, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
The host application calls init(); the telemetry request is scheduled five seconds later.
Impact
The API can learn that the project uses the SDK and which integration features are configured. No credential theft or account mutation was identified.
Mechanism
POSTs project ID, SDK version, integration flags, and configured environment/release values to apiBase/ingest/hello, at most once daily per project in the browser.
AI rationale
The SDK sends runtime installation telemetry automatically on init and provides no evident way to turn it off. The data is limited to project and integration metadata sent to the configured BugCatch API, so this warrants a warning rather than a block.
Evidence
src/index.jslocalStorage key bugcatch:hello:<projectId>
Network endpoints1
Configured apiBase/ingest/hello (default apiBase: http://localhost:3000)
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Calling init() invokes #sayHello(), which posts to /ingest/hello after a delay; the request is gated by a daily localStorage marker, not a telemetry opt-out.
- The hello request includes the project ID, SDK version, and identify/context/widget flags; it also includes the configured environment value.
- The hello request uses the configured apiBase, whose default is http://localhost:3000; the README example configures a BugCatch API host.
Evidence against
- There is no preinstall, install, or postinstall script; prepublishOnly only runs the build script.
- The hello request sends project and SDK configuration metadata rather than credentials or account actions.
- The SDK’s stated purpose is browser bug reporting, and its report payload includes collected context when a report is submitted.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/bugcatch.standalone.umd.jsView file
1(function(U,K){typeof exports=="object"&&typeof module<"u"?module.exports=K():typeof define=="function"&&define.amd?define(K):(U=typeof globalThis<"u"?globalThis:U||self,U.BugCatch...
L2: :host { all: initial; }
...
L290: .loadfail button svg { font-size: 13px; margin: 0; }
L291: `;function Wn(t){const e=document.createElement("div");e.setAttribute("data-bugcatch","widget");let n=Kn()||Yn(t.config.theme);e.className=Tt(n);const o=e.attachShadow({mode:"open"...
L292:
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch.standalone.umd.jsView on unpkg · L1src/updates.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
src/updates.js#virtual:normalized:round1View on unpkgFindings
2 High6 Medium4 Low
HighBrowser Session Account Hijackdist/bugcatch.standalone.umd.js
HighSemantic Analysis Limitedsrc/updates.js#virtual:normalized:round1
MediumNetwork
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.18.0.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.