@xmaxai/web-sdk@1.1.2
XmaxSDK for Web — Realtime Interactive Video Generation
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe default Agora reporting path sends the current page origin as runtime telemetry, and the package documentation does not disclose this collection. The flagged account-hijack behavior was not substantiated; the evidence supports a telemetry warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
When an Agora RTC client is created and the page is visible.
Impact
Agora receives the website origin. No credential theft or account action was identified.
Mechanism
The default preconnect reporter queues an event containing the target, mode, and current origin; the SDK sends events to its configured stats collector.
AI rationale
The default Agora reporting path sends the current page origin as runtime telemetry, and the package documentation does not disclose this collection. The flagged account-hijack behavior was not substantiated; the evidence supports a telemetry warning rather than a block.
Evidence
dist/browser/chunks/AgoraRTC_N-production-2PFQX2GK.js
Network endpoints2
statscollector-1.agora.ioweb-2.statscollector.sd-rtn.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Agora RTC telemetry is enabled by default, with client preconnect reporting in report mode.
- The report includes the current page origin along with target and mode fields.
- The SDK sends runtime events to Agora’s configured event reporting service.
- Creating an Agora client triggers the preconnect reporting task.
Evidence against
- The package describes Agora as an alternative RTC transport, so the vendor SDK serves the package’s stated purpose.
- The inspected reporting path contains no browser credentials or account mutation behavior.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
8 flaggeddist/browser/chunks/index.esm.min-32J2X22X.jsView file
38patternName = generic_password
severity = medium
line = 38
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/browser/chunks/index.esm.min-32J2X22X.jsView on unpkg · L38dist/browser/chunks/agora-extension-beauty-N2VYE3UU.jsView file
1import{a as Un}from"./chunk-P46332N2.js";var Nn=Un((YA,$A)=>{(function(TA,sA){typeof YA=="object"&&typeof $A=="object"?$A.exports=sA():typeof define=="function"&&define.amd?define(...
L2: `,"\\r":"\r","\\t":" "},i=/^[\da-f]{4}$/i,g=/^[\u0000-\u001F]$/;Q.exports=function(c,f){for(var B=!0,v="";f<c.length;){var u=t(c,f);if(u==="\\"){var D=A(c,f,f+2);if(C(o,D))v+=o[D],...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/browser/chunks/agora-extension-beauty-N2VYE3UU.jsView on unpkg · L1Findings
3 High6 Medium6 Low
HighSame File Env Network Executiondist/browser/chunks/AgoraRTC_N-production-2PFQX2GK.js
HighBrowser Session Account Hijackdist/browser/chunks/AgoraRTC_N-production-2PFQX2GK.js
HighSemantic Analysis Limiteddist/browser/chunks/AgoraRTC_N-production-2PFQX2GK.js
MediumSecret Patterndist/browser/chunks/index.esm.min-32J2X22X.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/browser/chunks/trtc-NSSG7IZO.js
MediumSecret Patterndist/browser/chunks/AgoraRTC_N-production-2PFQX2GK.js
MediumSecret Patterndist/browser/chunks/AgoraRTC_N-production-2PFQX2GK.js
LowScripts Present
LowEvaldist/browser/chunks/agora-extension-beauty-N2VYE3UU.js
Affected versions and remediation
This report applies to @xmaxai/web-sdk@1.1.2.
See all versions of @xmaxai/web-sdk for other recorded verdicts.
- Review the evidence and your use of @xmaxai/web-sdk@1.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.