registry / @sphoro/bugcatch-web-sdk / 0.19.0
@sphoro/bugcatch-web-sdk@0.19.0
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected source implements a browser bug-reporting SDK: capture begins after init(), report data goes to the configured API, and the documented collection is consistent with that purpose. The scanner’s account-hijack lead was not substantiated; no unrelated account mutation or credential destination was found.
Static reason
No blocking static signals were detected.
Trigger
The consumer calls init(); capture hooks then run, and reports are sent when the integration or reporter submits one.
Impact
Expected diagnostic reporting and project usage metadata; no unrelated credential collection or account mutation was identified.
Mechanism
The SDK captures disclosed diagnostic data and sends it to the configured BugCatch API. Its periodic hello request sends project and SDK metadata to that same configured API.
AI rationale
The inspected source implements a browser bug-reporting SDK: capture begins after init(), report data goes to the configured API, and the documented collection is consistent with that purpose. The scanner’s account-hijack lead was not substantiated; no unrelated account mutation or credential destination was found.
Evidence
src/index.jssrc/collectors.jssrc/identity.js
Network endpoints3
configured apiBase/ingest/helloconfigured apiBase/ingest/bugslocalhost:3000 (default apiBase)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle hook is prepublishOnly, which builds the package; there is no install hook.
- The README discloses that console, network metadata, errors, and environment are captured after init(), and says request bodies are not read.
- Capture hooks are installed during init() and controlled by capture options.
- The hello request reports limited project and SDK metadata to the configured API base once per day.
- Bug reports are posted to the configured API base through the documented ingest endpoint.
Evidence against
- Console, network, and error capture are enabled by default after init().
- The SDK sends an automatic hello request after init(), once per day per browser and project.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/bugcatch-core.es.jsView file
4var xt = (t, e, n) => e.has(t) || be("Cannot " + n);
L5: var xe = (t, e, n) => e.has(t) ? be("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(t) : e.set(t, n);
L6: var x = (t, e, n) => (xt(t, e, "access private method"), n);
...
L142: function jt(t, { slowMs: e = 2e3 } = {}) {
L143: const n = window.fetch, i = XMLHttpRequest.prototype.open, r = XMLHttpRequest.prototype.send;
L144: return n && (window.fetch = async function(...a) {
L145: var h, f, d;
...
L244: capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
L245: timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
L246: timezoneOffsetMinutes: (/* @__PURE__ */ new Date()).getTimezoneOffset(),
...
L256: rtt: t.connection.rtt,
L257: saveData: t.connection.saveData
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch-core.es.jsView on unpkg · L4src/updates.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High1 Medium9 Low
HighBrowser Session Account Hijackdist/bugcatch-core.es.js
HighSemantic Analysis Limitedsrc/updates.js#virtual:normalized:round1
MediumNetwork
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review EvidenceREADME.md
LowAi Review Evidencesrc/index.js
LowAi Review Evidencesrc/index.js
LowAi Review Evidencesrc/index.js
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.19.0.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.