registry / @applooma/rtc-web / 0.4.2
@applooma/rtc-web@0.4.2
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no malicious behavior or install-time execution. Network behavior is consistent with the package's browser RTC function.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls the SDK channel or history methods.
Impact
No unconsented installation action, credential harvesting, arbitrary endpoint forwarding, or destructive behavior was found.
Mechanism
The SDK connects to the caller-provided channel and sends its channel token to the fixed AppLooma API for history retrieval.
AI rationale
Static inspection found no malicious behavior or install-time execution. Network behavior is consistent with the package's browser RTC function.
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata contains build and type-check scripts, with no install lifecycle hook.
- The browser SDK connects only when its join method is called with caller-supplied channel details.
- The history request uses the stored channel token and a fixed AppLooma API base URL.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8989patternName = generic_password
severity = medium
line = 8989
Medium
dist/index.mjsView file
8960patternName = generic_password
severity = medium
line = 8960
Medium
30052await this.room.connect(wsUrl, token, { autoSubscribe: true });
this.joined = true;
this.emit("connection-stage", "connected", void 0, this.elapsedMs());
this.seedExist
Low
Ai Review Evidence
The browser SDK connects only when its join method is called with caller-supplied channel details.
dist/index.mjsView on unpkg · L30052Findings
4 Medium7 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.2.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.