registry / @applooma/rtc-web / 0.4.8
@applooma/rtc-web@0.4.8
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle execution or concrete malicious behavior. The observed telemetry is destination-bound, redacted, and aligned with the RTC SDK.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller uses the SDK; diagnostic uploads occur only during active SDK diagnostic handling.
Impact
No confirmed credential theft, arbitrary code execution, install-time mutation, persistence, or destructive behavior was found.
Mechanism
The bundle redacts sensitive-looking log values and sends diagnostics to the fixed AppLooma API endpoint.
AI rationale
Static inspection found no lifecycle execution or concrete malicious behavior. The observed telemetry is destination-bound, redacted, and aligned with the RTC SDK.
Evidence
package.jsondist/index.mjs
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes browser bundles and contains only build and type-check scripts, with no install lifecycle hook.
- Diagnostic requests use a fixed AppLooma API base rather than a caller-configurable destination.
- Diagnostic log processing replaces tokens, URL queries, secrets, personal fields, and user identifiers before upload.
- Remote diagnostics can be disabled through the SDK configuration.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
dist/index.mjsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
30290var API_BASE = "https://api.applooma.dev/v1";
var cleanField = (s, max) => (s ?? "").repla
Low
Ai Review Evidence
Diagnostic requests use a fixed AppLooma API base rather than a caller-configurable destination.
dist/index.mjsView on unpkg · L30290Findings
4 Medium7 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.8.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.