registry / @signalapp/ringrtc / 2.70.0

@signalapp/ringrtc@2.70.0

Signal Messenger voice and video calling library.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

Manifest

CopyleftLicense

scanned 6 file(s), 90.9 KB of source

Source & flagged code

3 flagged

package.jsonView file

Lines 11-51json

11 "types": "dist/index.d.ts",

12 "files": [

13 "dist/*.js",

14 "dist/*.d.ts",

15 "dist/ringrtc/*.js",

16 "dist/ringrtc/*.d.ts",

17 "dist/acknowledgments.md",

18 "scripts/fetch-prebuild.js"

19 ],

20 "bin": {

21 "virtual_audio": "dist/bin/virtual_audio.sh"

22 },

23 "scripts": {

24 "build": "tsc && bash scripts/build-help.sh",

25 "clean": "rimraf dist",

26 "test": "electron-mocha --renderer --recursive dist/test --timeout 10000 --require source-map-support/register",

27 "oxlint": "oxlint --format=stylish",

28 "lint": "npm run format --list-different && npm run oxlint",

29 "format": "prettier --write .",

30 "check-format": "prettier . --check",

31 "install": "node scripts/fetch-prebuild.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "prepublishOnly": "node scripts/prepublish.js"

33 },

34 "config": {

35 "prebuildUrl": "https://build-artifacts.signal.org/libraries/ringrtc-desktop-build-v${npm_package_version}.tar.gz",

36 "prebuildChecksum": "b04ad8194f2033f8c72caf126f7431f703c11c5764dc6f472d1cd31b20c6c147"

37 },

38 "author": "",

39 "license": "AGPL-3.0-only",

40 "dependencies": {

41 "https-proxy-agent": "7.0.6",

42 "tar": "7.5.15"

43 },

44 "devDependencies": {

45 "@types/chai": "5.2.3",

46 "@types/chai-as-promised": "8.0.2",

47 "@types/lodash": "4.17.21",

48 "@types/mocha": "10.0.10",

49 "@types/node": "25.0.3",

50 "@types/sinon-chai": "^4.0.0",

51 "chai": "6.2.2",

scripts/fetch-prebuild.jsView file

Lines 1-25javascript

1//

3// SPDX-License-Identifier: AGPL-3.0-only

4//

6const https = require('node:https');

7const { HttpsProxyAgent } =

dist/bin/virtual_audio.shView file

•path = dist/bin/virtual_audio.sh kind = build_helper sizeBytes = 8306 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/virtual_audio.shView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.install = node scripts/fetch-prebuild.js

High

Install Time Lifecycle Scripts

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code