@lineai/talk
Put a live LineAI voice conversation inside any interface you build: the voice connection, audio levels and agent events, with no UI.
This report shows the evidence for @lineai/talk@0.0.3. 0 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically uploads recorded call audio after hang-up without documenting the recording or offering an opt-out. Because audio transmission to the package's own service is part of the core call flow, this is a disclosure and consent risk rather than clear malicious exfiltration.
Decision evidence
public snapshot- Recording starts automatically when the remote audio stream arrives and a local stream exists.
- The recording helper describes three tracks: mixed, inbound, and outbound audio.
- On hang-up, the tracks are uploaded to the voice service's /webrtc/recording endpoint.
- The upload helper sends each nonempty track as a WebM blob in a POST request.
- The README lists the public options but does not document recording or provide a recording opt-out.
- Recording begins only during an explicitly started voice call, whose audio must be sent to the voice service.
- The destination is the package's own voice service, and the package also uses it to create the call session.
Source & flagged code
6 flaggedRecording starts automatically when the remote audio stream arrives and a local stream exists.
build/webrtc.jsView on unpkg · L298Recording starts automatically when the remote audio stream arrives and a local stream exists.
build/webrtc.jsView on unpkg · L83The recording helper describes three tracks: mixed, inbound, and outbound audio.
build/recording.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @lineai/talk@0.0.3.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @lineai/talk@0.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.