registry / @applooma/rtc-web / 0.4.12
@applooma/rtc-web@0.4.12
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe scanner’s secret-pattern finding corresponds to diagnostic redaction code, and the diagnostic sender targets the SDK’s own API. The manifest has no install hook, and the inspected voice bundles implement audio worklet processing.
Static reason
One or more suspicious static signals were detected.
Trigger
Joining a channel starts diagnostics; an app request, detected connection problem or reconnect pattern, or service-enabled diagnostics can trigger an upload.
Impact
No malicious impact was established; the observed behavior supports SDK diagnostics and audio processing.
Mechanism
The SDK scrubs diagnostic lines before sending them to its AppLooma API. The clear-voice bundles provide audio worklet processors.
AI rationale
The scanner’s secret-pattern finding corresponds to diagnostic redaction code, and the diagnostic sender targets the SDK’s own API. The manifest has no install hook, and the inspected voice bundles implement audio worklet processing.
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to browser bundles and declares only build and typecheck scripts; it has no install lifecycle hook.
- dist/index.mjs starts diagnostics when a channel is joined and uploads only after an app request, a detected problem or reconnects, or service-enabled diagnostics; configuration can disable them.
- The diagnostic scrubber replaces token-like, password, authorization, personal-field and URL-query values before logging them for upload.
- The CommonJS and ES module bundles send diagnostics to the package’s AppLooma API endpoint using the SDK API base.
- The clear-voice bundles create audio worklet nodes for noise processing.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
dist/index.mjsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
29915NNECTS) all.add(DIAG_PROBLEMS.reconnects);
if (all.size) return { trigger: "auto_problem", reason: Array.from(all).sort().join(",").slice(0, 64) };
if (remoteEnabled) return { trigger: "remote_enabled" };
return void 0;
}
var cleanRea
Low
Ai Review Evidence
dist/index.mjs starts diagnostics when a channel is joined and uploads only after an app request, a detected problem or reconnects, or service-enabled diagnostics; configuration can disable them.
Findings
4 Medium8 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.12.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.