registry  /  @formant/realtime-sdk  /  1.359.13

@formant/realtime-sdk@1.359.13

⚠ Under review

A library for accessing realtime connections your Formant devices/fleet.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEvalNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTrivialUrlStrings
Manifest
WildcardDependency
scanned 3 file(s), 996 KB of source, external domains: example.com, github.com

Source & flagged code

2 flagged · loading source
dist/index.jsView file
1!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.FormantRealt...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L1
dist/protos/api/signaling/v1/signaling_grpc_web_pb.jsView file
1const grpc={};grpc.web=require("grpc-web");var google_protobuf_wrappers_pb=require("google-protobuf/google/protobuf/wrappers_pb.js");const proto={v1:{}};proto.v1.signaling={},proto...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/protos/api/signaling/v1/signaling_grpc_web_pb.jsView on unpkg · L1

Findings

1 Critical4 Medium5 Low
CriticalProtestware
MediumDynamic Requiredist/protos/api/signaling/v1/signaling_grpc_web_pb.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowEvaldist/index.js
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings