@ujet/websdk-headless@6.22.0
A prebuilt infrastructure for communicating with your CCaaS servers!
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe scanner’s exfiltration hint is not supported by the inspected source: the observed credential send is part of SDK image upload to its configured service endpoint. The package manifest contains no lifecycle hooks, and the inspected evidence does not establish a malicious attack surface.
Decision evidence
public snapshot- package.json exports the package through browser SDK bundles.
- The image upload code sends data and the session token to a configured API endpoint.
- The bundled API configuration defaults that endpoint to Vonage’s image API.
- No source evidence inspected confirms a package-controlled credential or record exfiltration path.
Source & flagged code
3 flaggedSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to @ujet/websdk-headless@6.22.0.
See all versions of @ujet/websdk-headless for other recorded verdicts.
- Review the evidence and your use of @ujet/websdk-headless@6.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.