registry / @applooma/rtc-web / 0.4.7
@applooma/rtc-web@0.4.7
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install-time lifecycle execution and its observed authenticated requests are bound to a fixed package-aligned endpoint. Static inspection found no concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller joins a channel using the SDK.
Impact
No malicious execution, persistence, credential forwarding to an unrestricted destination, or destructive behavior was found.
Mechanism
The SDK requests device configuration with the caller-supplied join token and records redacted diagnostics.
AI rationale
The package has no install-time lifecycle execution and its observed authenticated requests are bound to a fixed package-aligned endpoint. Static inspection found no concrete malicious behavior.
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata declares only build and type-check scripts, with no install lifecycle hook.
- The exported SDK uses a fixed AppLooma API base for device configuration.
- The configuration request sends its supplied join token only to that fixed API endpoint.
- Diagnostic log processing redacts tokens, URL queries, secret fields, and personal fields before upload.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8990patternName = generic_password
severity = medium
line = 8990
Medium
dist/index.mjsView file
8960patternName = generic_password
severity = medium
line = 8960
Medium
30049ar SDK_VERSION = "0.4.7";
var API_BASE = "https://api.applooma.dev/v1";
var cleanField = (s, max) => (s ?? "").replace(/[^A-Za-z0-9 ._\-+/(),:#]/g, " ").trim().slice(0, max) || "unknown";
var PLATFORM = "web";
function deviceInfo() {
const ua = globalThis.na
Low
Ai Review Evidence
The exported SDK uses a fixed AppLooma API base for device configuration.
dist/index.mjsView on unpkg · L30049Findings
4 Medium7 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.7.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.