registry / @applooma/rtc-web / 0.4.6
@applooma/rtc-web@0.4.6
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or malicious execution primitive. The observed authenticated requests are package-aligned service calls activated by SDK use.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls joinChannel or explicitly requests diagnostic upload.
Impact
No unconsented install-time execution, filesystem mutation, credential harvesting, or confirmed exfiltration was found.
Mechanism
The SDK sends authenticated configuration requests to its fixed service API and connects to the caller-supplied RTC WebSocket URL.
AI rationale
Static inspection found no lifecycle hook or malicious execution primitive. The observed authenticated requests are package-aligned service calls activated by SDK use.
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata exposes bundled browser entrypoints and contains only build and type-check scripts, with no install lifecycle hook.
- The SDK network connection is activated through the caller-invoked joinChannel method, which receives the token and WebSocket URL.
- Device configuration uses the supplied token to authenticate to the fixed AppLooma API endpoint.
- Diagnostic upload is an explicit SDK method and is described as limited to scrubbed SDK log lines.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8989patternName = generic_password
severity = medium
line = 8989
Medium
dist/index.mjsView file
8960patternName = generic_password
severity = medium
line = 8960
Medium
30807async joinChannel(token, wsUrl, options = {}) {
this.token = token;
if (this.joined) throw new Error("Already in a channel \u2014 call leaveChannel() first");
this.joinStartedAt = Date.now();
this.fallbackUsed = false;
this.reported.clear();
co
Low
Ai Review Evidence
The SDK network connection is activated through the caller-invoked joinChannel method, which receives the token and WebSocket URL.
dist/index.mjsFindings
4 Medium7 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.6.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.