@sphoro/bugcatch-web-sdk@0.20.0
Drop-in browser SDK — report bugs with console, network and environment context, without the extension.
AI Security Review
scanned 1d ago · by lpm-firewall-aiInitialization sends runtime telemetry to the configured API and the browser Origin header identifies the site using the SDK. The request is described in source, but no visible opt-out was found; the flagged account-hijack behavior was not confirmed.
Static reason
No blocking static signals were detected.
Trigger
SDK init, at most once daily per project and browser.
Impact
The service learns which site uses the SDK. This identifying runtime telemetry has no visible opt-out, so it warrants a warning.
Mechanism
After a five-second delay, POSTs project and SDK metadata to the configured API base; the browser also supplies the site's Origin header.
AI rationale
Initialization sends runtime telemetry to the configured API and the browser Origin header identifies the site using the SDK. The request is described in source, but no visible opt-out was found; the flagged account-hijack behavior was not confirmed.
Evidence
src/index.jsbrowser localStorage key bugcatch:hello:{projectId}
Network endpoints1
{configured apiBase}/ingest/hello (default apiBase: http://localhost:3000)
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Initialization sends a once-daily `/ingest/hello` POST to the configured API base, using the project API key.
- The hello request relies on the browser Origin header, which identifies the site using the SDK.
- The hello payload includes project ID, SDK version, and whether user identification and context are configured.
- The package describes this request as reporting which site has the SDK installed, but provides no visible opt-out.
Evidence against
- The package is a browser bug-reporting SDK, and its report and sign-in requests use the configured API base.
- The inspected issue-following action is initiated by a user click; no account mutation was identified during initialization.
- The hello payload contains project and configuration metadata rather than credentials, files, or report contents.
Behavioral surface
NetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/bugcatch-core.es.jsView file
4var xt = (t, e, n) => e.has(t) || be("Cannot " + n);
L5: var xe = (t, e, n) => e.has(t) ? be("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(t) : e.set(t, n);
L6: var x = (t, e, n) => (xt(t, e, "access private method"), n);
...
L142: function jt(t, { slowMs: e = 2e3 } = {}) {
L143: const n = window.fetch, i = XMLHttpRequest.prototype.open, r = XMLHttpRequest.prototype.send;
L144: return n && (window.fetch = async function(...a) {
L145: var h, f, d;
...
L244: capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
L245: timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
L246: timezoneOffsetMinutes: (/* @__PURE__ */ new Date()).getTimezoneOffset(),
...
L256: rtt: t.connection.rtt,
L257: saveData: t.connection.saveData
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/bugcatch-core.es.jsView on unpkg · L4src/updates.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
Findings
2 High5 Medium4 Low
HighBrowser Session Account Hijackdist/bugcatch-core.es.js
HighSemantic Analysis Limitedsrc/updates.js#virtual:normalized:round1
MediumNetwork
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
MediumAi Review Evidencesrc/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sphoro/bugcatch-web-sdk@0.20.0.
See all versions of @sphoro/bugcatch-web-sdk for other recorded verdicts.
- Review the evidence and your use of @sphoro/bugcatch-web-sdk@0.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.