registry / @meetelise/chat / 1.55.2
@meetelise/chat@1.55.2
### Installation
AI Security Review
scanned 8d ago · by lpm-firewall-aiStatic inspection found ordinary chat-service requests to MeetElise endpoints and a postinstall hook that sorts package metadata. The scanner's install and network signals are explained by these inspected behaviors; no concrete attack was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package runs its postinstall hook; using the chat client starts its service requests.
Impact
The inspected behavior supports package setup and chat operation; it does not establish unrelated credential disclosure or another attack.
Mechanism
The hook invokes sort-package-json. Runtime requests send chat or logging data to MeetElise endpoints, and the chat client uses a service-issued session token for PubNub.
AI rationale
Static inspection found ordinary chat-service requests to MeetElise endpoints and a postinstall hook that sorts package metadata. The scanner's install and network signals are explained by these inspected behaviors; no concrete attack was established.
Evidence
package.jsonsrc/analytics.tssrc/MyPubnub.tspublic/dist/index.js
Network endpoints2
app.meetelise.commeetelise.pubnubapi.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package's postinstall hook runs sort-package-json; the inspected manifest shows no install-time download or shell command.
- The chat client sends logging data to the MeetElise service with organization and building identifiers.
- Chat initialization sends building and organization identifiers to the configured webchat API and uses the returned session token for PubNub authentication.
- The bundled TalkJS analytics request omits browser credentials and sends chat event details to the MeetElise service.
- Generated model modules expose JSON-to-model conversion helpers, with field mappings or typed parsers for the named API data.
- The report, calendar-event, and tour-info model files define fixed enum values.
- The dashboard model imports related report, layout, agent, calendar-event, and unit models.
- Each inspected model file defines a typed JSON parsing function that accepts JSON input.
Evidence against
Behavioral surface
EnvironmentVarsEvalNetwork
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = sort-package-json
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = sort-package-json
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpublic/dist/index.jsView file
1var e={2:(e,t,n)=>{var i=n(2199),r=n(4664),o=n(5950);e.exports=function(e){return i(e,o,r)}},79:(e,t,n)=>{var i=n(3702),r=n(80),o=n(4739),a=n(8655),s=n(1175);function l(e){var t=-1...
L2: .webchat-input {
Low
Eval
Package source references a known benign dynamic code generation pattern.
public/dist/index.jsView on unpkg · L1Findings
1 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdeploy.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalpublic/dist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @meetelise/chat@1.55.2.
See all versions of @meetelise/chat for other recorded verdicts.
- Review the evidence and your use of @meetelise/chat@1.55.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.