registry / @applooma/rtc-web / 0.4.9
@applooma/rtc-web@0.4.9
AppLooma RTC Web SDK — real-time voice, video, live streaming and audio rooms for the browser
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected entrypoint behavior is consistent with a browser RTC SDK and contains no concrete malicious behavior. Network activity is directed to the package-aligned fixed API and diagnostics have activation gates.
Static reason
One or more suspicious static signals were detected.
Trigger
An application creates and joins an AppLooma engine session.
Impact
No unconsented install-time execution, credential harvesting, arbitrary code execution, persistence, or destructive behavior was identified.
Mechanism
The SDK requests device configuration and conditionally sends diagnostics to the fixed AppLooma API.
AI rationale
The inspected entrypoint behavior is consistent with a browser RTC SDK and contains no concrete malicious behavior. Network activity is directed to the package-aligned fixed API and diagnostics have activation gates.
Evidence
package.jsondist/index.mjs
Network endpoints1
api.applooma.dev/v1
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package declares browser distribution entrypoints and only build and type-check scripts, with no install lifecycle hook.
- The SDK fetches device configuration from its fixed AppLooma API endpoint and caches the result.
- Diagnostic uploads are gated by the enabled setting and explicit request, call problems, or remote enablement.
Evidence against
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
dist/index.mjsView file
8962patternName = generic_password
severity = medium
line = 8962
Medium
30331if (cache?.etag) headers["If-None-Match"] = cache.etag;
const res = await fetch(`${API_BASE}/sdk/device-config?${q}`, { headers, signal: ctl?.signal });
if (res.status === 304 && cache) {
writeConfigCache({ ...cache, at: Date.now() });
return void 0;
}
if (!res.ok) return void 0;
const body = await res.json();
const video = body?.video && typeof body.video === "object" ?
Low
Ai Review Evidence
Findings
4 Medium6 Low
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index.mjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @applooma/rtc-web@0.4.9.
See all versions of @applooma/rtc-web for other recorded verdicts.
- Review the evidence and your use of @applooma/rtc-web@0.4.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.