registry / @applooma/rtc-web / 0.4.3
@applooma/rtc-web@0.4.3
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or concrete malicious behavior. The observed authenticated request is package-aligned SDK functionality directed to a fixed service endpoint.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller must create and use the SDK, then request chat history after joining a channel.
Impact
No unconsented install-time action, credential harvesting, or unrelated data export was identified.
Mechanism
The SDK sends an authenticated request to its fixed AppLooma API base for chat history.
AI rationale
Static inspection found no lifecycle hook or concrete malicious behavior. The observed authenticated request is package-aligned SDK functionality directed to a fixed service endpoint.
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata declares only build and type-check scripts, with no install lifecycle hook.
- The exported browser SDK uses a fixed AppLooma API base for chat history after a channel token exists.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8989patternName = generic_password
severity = medium
line = 8989
Medium
dist/index.mjsView file
8960patternName = generic_password
severity = medium
line = 8960
Medium
30290async loadHistory(options = {}) {
if (!this.token) throw new Error("Join a channel before loading its history");
const query = new URLSearchParams();
if (options.limit) query.set("lim
Low
Ai Review Evidence
The exported browser SDK uses a fixed AppLooma API base for chat history after a channel token exists.
dist/index.mjsView on unpkg · L30290Findings
4 Medium7 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.3.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.