registry / @ujet/websdk-headless / 6.11.1
@ujet/websdk-headless@6.11.1
A prebuilt infrastructure for communicating with your CCaaS servers!
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a browser communications SDK with package-aligned network and voice functionality. The scanner's exfiltration signal is explained by an explicit connectivity-report helper and does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing and using the Client or explicitly calling connectivity reporting.
Impact
The connectivity diagnostic can obtain the browser's public IP; no unconsented credential or local-file exfiltration was found.
Mechanism
Browser API, chat, voice, and diagnostic network requests.
AI rationale
This is a browser communications SDK with package-aligned network and voice functionality. The scanner's exfiltration signal is explained by an explicit connectivity-report helper and does not establish malicious behavior.
Evidence
package.jsonREADME.mddist/index.jsdist/index.mjs
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The bundle includes a public-IP lookup used by an explicit connectivity-report method.
- Runtime requests use the configured UJET API host for chat-session operations.
Evidence against
- package.json has no lifecycle scripts and only exposes browser library entrypoints.
- No child-process, filesystem-write, environment harvesting, or install-time execution was found.
- The public-IP lookup is scoped to a connectivity-report routine, not import-time behavior.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/index.jsView file
•Credential-bearing message sent to a fixed external iframe in dist/index.js:
"use strict";var _q=Object.defineProperty;var gE=r=>{throw TypeError(r)};var bq=(r,e,t)=>e in r?_q(r,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):r[e]=t;var Se=(r,e,t)=>b...
`+en),Ot&&wh([Q,Oe,Ve],mn=>{en=Zl(en,mn," ")}),x&&Mr?x.createHTML(en):en},e.setConfig=function(){let vt=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};Me(vt),zt=!0},e.cl...
`)),At=et-1,lt=Math.max(At-3,0),Jr=Math.min(At+3,ct.length);return ie(ct.slice(lt,Jr),function(tn,St,ui){return tn[lt+1+ui]=St.length<=V?St:St.substr(0,V),tn},{})};p.config.beforeS...
`.replace(/\s*\/\/.*$/gm,"").replace(/\n/g,"").trim(),GV=new RegExp(`(?:^${Us}$)|(?:^${Xv}$)`),zV=new RegExp(`^${Us}$`),KV=new RegExp(`^${Xv}$`),Rw=r=>r&&r.exact?GV:new Re
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg38
Findings
1 Critical1 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
LowAi Review Evidencedist/index.mjs
Affected versions and remediation
This report applies to @ujet/websdk-headless@6.11.1.
See all versions of @ujet/websdk-headless for other recorded verdicts.
- Review the evidence and your use of @ujet/websdk-headless@6.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.