registry / @lineai/talk / 0.0.2
@lineai/talk@0.0.2
⚠ Under reviewPut a live LineAI voice conversation inside any interface you build: the voice connection, audio levels and agent events, with no UI.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected code shows user-invoked voice connection behavior and no install-time hook or confirmed attack. Firebase is a selected runtime dependency on the anonymous authentication path, and its source was unresolved, so this review cannot clear the package as clean.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling startTalk without a supplied token triggers anonymous Firebase authentication before connection.
Impact
No concrete malicious impact was established; review of the authentication dependency is incomplete.
Mechanism
The package obtains an anonymous Firebase identity and uses its token for a session request to the LineAI service; the unresolved Firebase dependency leaves that part of the runtime unverified.
AI rationale
The inspected code shows user-invoked voice connection behavior and no install-time hook or confirmed attack. Firebase is a selected runtime dependency on the anonymous authentication path, and its source was unresolved, so this review cannot clear the package as clean.
Evidence
package.jsonbuild/auth.jsbuild/talk.jsbuild/webrtc.js
Network endpoints2
public.voice.getline.aiapi.openai.com/v1/realtime/calls
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package declares Firebase as a runtime dependency, and its authentication module imports Firebase app and auth functions.
- The exported runtime uses anonymous Firebase sign-in when no caller token is provided; that dependency’s source could not be verified in this bounded review.
Evidence against
- The manifest shows a prepublishOnly build script and no install-time lifecycle hook.
- Inspected runtime code sends authentication to the package’s LineAI voice service and uses an ephemeral session key for OpenAI realtime negotiation.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/talk.jsView file
15patternName = google_api_key
severity = high
line = 15
High
15patternName = google_api_key
severity = high
line = 15
High
build/auth.jsView file
9patternName = google_api_key
severity = high
line = 9
High
1import { initializeApp, getApps } from 'firebase/app';
import { getAuth, signInAnonymously } from 'firebase/auth';
// Public client-side values, same dedicated key as the embed ("LineAI Embed
// Iframe", GCP ke
Findings
3 High2 Medium7 Low
HighHigh Secretdist/talk.js
HighSecret Patterndist/talk.js
HighSecret Patternbuild/auth.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencebuild/auth.js
LowSuspicious Dependency Evidencebuild/auth.js
Affected versions and remediation
This report applies to @lineai/talk@0.0.2.
See all versions of @lineai/talk for other recorded verdicts.
- Review the evidence and your use of @lineai/talk@0.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.