registry / @applooma/rtc-web / 0.4.11
@applooma/rtc-web@0.4.11
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. The network and credential-related signals correspond to SDK requests to its own service, while diagnostics are requested by the consuming application.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer application uses the SDK to join a channel; diagnostics upload follows an application request.
Impact
The inspected transfers go to the SDK’s own service, with no confirmed unrelated credential recipient or malicious execution behavior.
Mechanism
The SDK sends device and codec details to its fixed AppLooma API host. Audio processing uses browser worklets and same-origin WASM loading.
AI rationale
Source inspection found no install hook or concrete attack behavior. The network and credential-related signals correspond to SDK requests to its own service, while diagnostics are requested by the consuming application.
Evidence
package.jsondist/index.jsdist/index.mjsdist/clearVoice-IUBZAWFT.mjsdist/clearVoice-QXONXTRF.js
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has only build and typecheck scripts, with no install lifecycle hook.
- Both runtime bundles use AppLooma’s fixed API host for device configuration and codec reports; the reports contain browser/device and codec details.
- Diagnostics upload follows an application request, and the API documentation says the uploaded SDK logs are scrubbed of names, metadata, tokens, and URL parameters.
- The audio worklet bundles process audio using WASM, which may be fetched with same-origin credentials.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
30290API_BASE = "https://api.applooma.dev/v1";
var cleanField = (s, max) => (_nullishCoalesce(s, () => ( ""))).replace(/[^A-Za-z0-9 ._\-+/(),:#]/g, " ").trim().slice(0, max) || "unknown";
var PLATFORM = "web";
function deviceInfo() {
const ua = _nullishCoalesce(_optionalChain([globalThis, 'access', _5 => _5.navigator, 'optionalAccess', _6 => _6.userAgent]), ()
Low
Ai Review Evidence
Both runtime bundles use AppLooma’s fixed API host for device configuration and codec reports; the reports contain browser/device and codec details.
dist/index.jsView on unpkg · L30290dist/index.mjsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
Findings
4 Medium8 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.11.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.