@applooma/rtc-web
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
This report shows the evidence for @applooma/rtc-web@0.4.13. 0 of 13 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe package performs default runtime diagnostics uploads after problems or repeated reconnects, although the public API documents only an explicit user-requested upload. This undisclosed automatic telemetry is limited by a configuration opt-out and log scrubbing, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
An SDK session encounters a problem or repeated reconnects and ends; remoteDiagnostics is not set to false.
Impact
Potentially unexpected diagnostic data is sent to the vendor; the code describes scrubbing sensitive values and excludes media and messages.
Mechanism
The SDK gathers diagnostic lines and device details, then posts them to AppLooma’s diagnostics endpoint with the session token.
AI rationale
The package performs default runtime diagnostics uploads after problems or repeated reconnects, although the public API documents only an explicit user-requested upload. This undisclosed automatic telemetry is limited by a configuration opt-out and log scrubbing, so it warrants a warning rather than a block.
Evidence
dist/index.jsdist/index.d.ts
Network endpoints1
api.applooma.dev/v1/sdk/diag
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package has no install lifecycle hooks; its scripts are build and typecheck only.
- Diagnostics upload automatically when SDK problems occur, and remote diagnostics are enabled unless explicitly disabled.
- The diagnostics request posts to AppLooma’s own API using the SDK session token.
- The public type documentation describes an explicit diagnostics upload as sending scrubbed SDK log lines and says it does not send audio, video, or messages.
Evidence against
- Diagnostics can be disabled with remoteDiagnostics: false.
- The documented diagnostics feature says names, metadata, tokens, and URL parameters are scrubbed from uploaded SDK log lines.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
29913: appReason };
const all = new Set(problems);
if (reconnects >= REPEATED_RECONNECTS) all.add(DIAG_PROBLEMS.reconnects);
if (all.size) return { trigger: "auto_problem", reason: Array.from(all).sort().join(",").slice(0, 64) };
if (remoteEnabled) return { trigger: "remote_enabled" };
return void 0;
}
var cleanReason = (s) => String(_nullishCoalesce(s, () => ( ""))).replace(/[^A-Za-z0-9 ._\-+/(),:#]/g, " ").trim().slice(0, 64) || "app";
var DiagCollector = class {
constructor(o2) {
this.o = o2;
this.enabled = true;
this.remoteEnabled = false;
this.ac
Medium
Ai Review Evidence
Diagnostics upload automatically when SDK problems occur, and remote diagnostics are enabled unless explicitly disabled.
dist/index.jsView on unpkg · L2991329960id 0;
this.maybeUpload(true);
}
request(reason) {
this.appReason = cleanReason(reason);
this.log("diag: app requested upload");
if (this.active) this.maybeUpload(false, true);
}
maybeUpload(final, force = false) {
try {
const d = decideDiag(this.enabled, this.appReason, this.problems, this.reconnects, this.remoteEnabled);
if (final) {
this.problems.clear();
this.reconnects = 0;
}
const token = this.token;
if (!d || !token) return;
if (!final && !force && this.uploaded) return;
if
Findings
9 Medium3 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.13.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @applooma/rtc-web@0.4.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.