registry / @ujet/websdk-headless / 5.5.1
@ujet/websdk-headless@5.5.1
A prebuilt infrastructure for communicating with your CCaaS servers!
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe flagged credential-bearing request is a configured UJET API call for an active chat session, not credential harvesting or exfiltration. Network and storage primitives are consistent with the documented browser communications SDK.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application imports, constructs, and uses Client; optional cobrowse is feature-enabled at runtime.
Impact
Normal SDK handling of caller-provided authentication and user-initiated support-session data; no unconsented host mutation or payload execution found.
Mechanism
Browser chat, voice, telemetry, and optional cobrowse requests
AI rationale
The flagged credential-bearing request is a configured UJET API call for an active chat session, not credential harvesting or exfiltration. Network and storage primitives are consistent with the documented browser communications SDK.
Evidence
package.jsonREADME.mddist/index.jsdist/index.d.ts
Network endpoints3
main.api.ujet.cowebsdk.ujet.co/v3/bridge.htmljs.cobrowse.io/CobrowseIO.js
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no lifecycle scripts or bin entry.
- README.md documents explicit Client construction with a caller-provided authenticate callback.
- dist/index.d.ts defines a browser customer-support/chat and voice SDK API.
- dist/index.js sends authenticated chat-leave requests only to the configured UJET host.
- dist/index.js loads Cobrowse only through an enabled runtime feature and HTTPS origin.
- No child-process, filesystem-write, eval, or install-time execution found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
3 flaggeddist/index.jsView file
•Credential-bearing message sent to a fixed external iframe in dist/index.js:
"use strict";var j4=Object.defineProperty;var GT=r=>{throw TypeError(r)};var U4=(r,e,t)=>e in r?j4(r,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):r[e]=t;var Re=(r,e,t)=>U...
`+Zr),Ot&&sh([J,Oe,He],vn=>{Zr=jl(Zr,vn," ")}),B&&xr?B.createHTML(Zr):Zr},e.setConfig=function(){let vt=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};Me(vt),zt=!0},e.cl...
`)),At=et-1,lt=Math.max(At-3,0),Kr=Math.min(At+3,ct.length);return re(ct.slice(lt,Kr),function(en,St,ni){return en[lt+1+ni]=St.length<=W?St:St.substr(0,W),en},{})};p.config.beforeS...
`.replace(/\s*\/\/.*$/gm,"").replace(/\n/g,"").trim(),lV=new RegExp(`(?:^${xs}$)|(?:^${Pv}$)`),dV=new RegExp(`^${xs}$`),fV=new RegExp(`^${Pv}$`),iw=r=>r&&r.exact?lV:new Re
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg38
Findings
1 Critical1 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ujet/websdk-headless@5.5.1.
See all versions of @ujet/websdk-headless for other recorded verdicts.
- Review the evidence and your use of @ujet/websdk-headless@5.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.