registry / @ujet/websdk-headless / 6.30.0
@ujet/websdk-headless@6.30.0
A prebuilt infrastructure for communicating with your CCaaS servers!
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe static credential-transfer signal resolves to ordinary SDK authentication and a chat-leave request sent to the configured service host. The manifest has no lifecycle scripts, and the inspected bundle locations show no unrelated credential collection or recipient.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The SDK invokes chat-leave behavior during page teardown when a token and host are present.
Impact
No unrelated credential recipient, install-time action, or other confirmed attack surface was found in the inspected source.
Mechanism
It sends an empty POST to the configured host’s chat-leave route with the SDK auth token; authentication tokens otherwise come from the consumer’s callback and enter the UJET authentication flow.
AI rationale
The static credential-transfer signal resolves to ordinary SDK authentication and a chat-leave request sent to the configured service host. The manifest has no lifecycle scripts, and the inspected bundle locations show no unrelated credential collection or recipient.
Evidence
package.jsondist/index.mjsdist/index.js
Network endpoints2
main.api.ujet.cowebsdk.ujet.co/v3/bridge.html
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exports the two distribution bundles and defines no lifecycle scripts.
- The chat-leave request requires an existing auth token and configured host, then posts to that host’s chat-leave route with the token as a bearer credential.
- Authentication obtains a token through the consumer’s authenticate callback and sends it to the UJET bridge/server authentication flow; the default API and bridge hosts are UJET endpoints.
- The CommonJS bundle shows the same configured-host chat-leave request and bearer header as the ES module.
- Early flagged bundle offsets contain private-field helper code, token-freshness logic, and event-manager setup, not a separate credential collection or transfer path.
Evidence against
- The flagged authorization header does transmit a token, but the source ties it to a chat-leave request at the configured SDK host and only sends when both the token and host exist.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
Source & flagged code
3 flaggeddist/index.jsView file
•Credential-bearing message sent to a fixed external iframe in dist/index.js:
"use strict";var Pq=Object.defineProperty;var CE=r=>{throw TypeError(r)};var Iq=(r,e,t)=>e in r?Pq(r,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):r[e]=t;var be=(r,e,t)=>I...
`+en),Ot&&Eh([Q,Oe,Ve],yn=>{en=rd(en,yn," ")}),x&&Mr?x.createHTML(en):en},e.setConfig=function(){let vt=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};Me(vt),zt=!0},e.cl...
`)),At=et-1,lt=Math.max(At-3,0),Jr=Math.min(At+3,ct.length);return ie(ct.slice(lt,Jr),function(tn,St,li){return tn[lt+1+li]=St.length<=V?St:St.substr(0,V),tn},{})};p.config.beforeS...
`.replace(/\s*\/\/.*$/gm,"").replace(/\n/g,"").trim(),hH=new RegExp(`(?:^${qs}$)|(?:^${ng}$)`),pH=new RegExp(`^${qs}$`),vH=new RegExp(`^${ng}$`),Dw=r=>r&&r.exact?hH:new Re
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.jsView on unpkg38
Findings
1 Critical1 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumSecret Patterndist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ujet/websdk-headless@6.30.0.
See all versions of @ujet/websdk-headless for other recorded verdicts.
- Review the evidence and your use of @ujet/websdk-headless@6.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.