registry / cogito-client / 1.0.76

cogito-client@1.0.76

This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and browser storage behavior is package-aligned for a React/LiveKit chat client and is activated by consumer use of useCogito.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls useCogito.connect/sendMessage/newChat or uses CogitoSurfaceServer stream helpers.

Impact

Expected client chat/voice functionality; no evidence of exfiltration, install-time mutation, persistence, or destructive behavior.

Mechanism

User-invoked chat token fetch, LiveKit connection, message publish, and localStorage conversation ID management.

Rationale

Static inspection shows a bundled React client for Cogito/LiveKit with user-supplied server connectivity and expected browser state management, not unconsented install-time or import-time behavior. Suspicious scanner hits are explained by bundled LiveKit/protobuf/JWT code and application-facing token/connection fields.

Evidence

package.jsondist/index.jsdist/index.umd.cjsdist/index.d.tsREADME.md

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks; published entries are dist/index.js and dist/index.umd.cjs.
dist/index.js exports only useCogito and CogitoSurfaceServer; no import-time side effects beyond module definitions.
useCogito fetches a chat token from the caller-provided server at /api/chat/token and connects to caller-provided LiveKit serverURL/token returned by that API.
Browser storage use is limited to cogitoConversationId keys for conversation continuity and removal on newChat.
No child_process, filesystem writes, eval/Function, dynamic require/import, native loading, persistence, or credential harvesting found in package code.
README.md is the default Vite React template; scanner secret/protestware hints map to bundled LiveKit/protobuf strings, not attack behavior.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1.02 MB of source, external domains: aomediacodec.github.io

Source & flagged code

1 flagged

dist/index.umd.cjsView file

Lines 1-32javascript

1(function(Qe,z){typeof exports=="object"&&typeof module<"u"?z(exports,require("react")):typeof define=="function"&&define.amd?define(["exports","react"],z):(Qe=typeof globalThis<"u"?globalThis:Qe||self,z(Qe["cogito-client"]={},Qe.React))})(this,(function(Qe,z){"use strict";function za(n,e){return e.forEach(function(t){t&&typeof t!="string"&&!Array.isArray(t)&&Object.keys(t).forEach(function(i){if(i!=="default"&&!(i in n)){var s=Object.getOwnPropertyDescriptor(t,i);Object.defineProperty(n,i,s.get?s:{enumerable:!0,get:function(){return t[i]}})}})}),Object.freeze(n)}var Qa=Object.defineProperty,Y ...

2`:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[i++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2

3`).map(i=>i.trim())},e.splitSections=function(t){return t.split(`

4m=`).map((s,r)=>(r>0?"m="+s:s).trim()+`\r

5`)},e.getDescription=function(t){const i=e.splitSections(t);return i&&i[0]},e.getMediaSections=function(t){const i=e.splitSections(t);return i.shift(),i},e.matchPrefix=function(t,i){return e.splitLines(t).filter(s=>s.indexOf(i)===0)},e.parseCandidate=function(t){let i;t.indexOf("a=candidate:")===0?i=t.substring(12).split(" "):i=t.substring(10).split(" ");const s={foundation:i[0],component:{1:"rtp",2:"rtcp"}[i[1]]||i[1],protocol:i[2].toLowerCase(),priority:parseInt(i[3],10),ip:i[4],address:i[4],port:parseInt(i[5],10),type:i[7]};for(let r=8;r<i.length;r+=2)switch(i[r]){case"raddr":s.relatedAddre ...

6`},e.parseExtmap=function(t){const i=t.substring(9).split(" ");return{id:parseInt(i[0],10),direction:i[0].indexOf("/")>0?i[0].split

7`},e.parseFmtp=function(t){const i={};let s;const r=t.substring(t.indexOf(" ")+1).split(";");for(let o=0;o<r.length;o++)s=r[o].trim().split("="),i[s[0].trim()]=s[1];return i},e.writeFmtp=function(t){let i="",s=t.payloadType;if(t.preferredPayloadType!==void 0&&(s=t.preferredPayloadType),t.parameters&&Object.keys(t.parameters).length){const r=[];Object.keys(t.parameters).forEach(o=>{t.parameters[o]!==void 0?r.push(o+"="+t.parameters[o]):r.push(o)}),i+="a=fmtp:"+s+" "+r.join(";")+`\r

8`}return i},e.parseRtcpFb=function(t){const i=t.substring(t.indexOf(" ")+1).split(" ");return{type:i.shift(),parameter:i.join(" ")}},e.writeRtcpFb=function(t){let i="",s=t.payloadType;return t.preferredPayloadType!==void 0&&(s=t.preferredPayloadType),t.rtcpFeedback&&t.rtcpFeedback.length&&t.rtcpFeedback.forEach(r=>{i+="a=rtcp-fb:"+s+" "+r.type+(r.parameter&&r.parameter.length?" "+r.parameter:"")+`\r

9`}),i},e.parseSsrcMedia=function(t){const i=t.indexOf(" "),s={ssrc:parseInt(t.substring(7,i),10)},r=t.indexOf(":",i);return r>-1?(s.attribute=t.substring(i+1,r),s.value=t.substring(r+1)):s.attribute=t.substring(i+1),s},e.parseSsrcGroup=function(t){const i=t.substring(13).split(" ");return{semantics:i.shift(),ssrcs:i.map(s=>parseInt(s,10))}},e.getMid=function(t){const i=e.matchPrefix(t,"a=mid:")[0];if(i)return i.substring(6)},e.parseFingerprint=function(t){const i=t.substring(14).split(" ");return{algorithm:i[0].toLowerCase(),value:i[1].toUpperCase()}},e.getDtlsParameters=function(t,i){return{r ...

10`;return t.fingerprints.forEach(r=>{s+="a=fingerprint:"+r.algorithm+" "+r.value+`\r

11`}),s},e.parseCryptoLine=function(t){const i=t.substring(9).split(" ");return{tag:parseInt(i[0],10),cryptoSuite:i[1],keyParams:i[2],sessionParams:

12`},e.parseCryptoKeyParams=function(t){if(t.indexOf("inline:")!==0)return null;const i=t.substring(7).split("|");return{keyMethod:"inline",keySalt:i[0],lifeTime:i[1],mkiValue:i[2]

13a=ice-pwd:`+t.password+`\r

14`;return t.iceLite&&(i+=`a=ice-lite\r

15`),i},e.parseRtpParameters=function(t){const i={codecs:[],headerExtensions:[],fecMechanisms:[],rtcp:[]},r=e.splitLines(t)[0].split(" ");i.profile=r[2];for(let a=3;a<r.length;a++){const c=r[a],d=e.matchPrefix(t,"a=rtpmap:"+c+" ")[0];if(d){const l=e.parseRtpMap(d),u=e.matchPrefix(t,"a=fmtp:"+c+" ");switch(l.parameters=u.length?e.parseFmtp(u[0]):{},l.rtcpFeedback=e.matchPrefix(t,"a=rtcp-fb:"+c+" ").map(e.parseRtcpFb),i.codecs.push(l),l.name.toUpperCase()){case"RED":case"ULPFEC":i.fecMechanisms.push(l.name.toUpperCase());break}}}e.matchPrefix(t,"a=extmap:").forEach(a=>{i.headerExtensions.push(e.pa ...

16`,s+=`c=IN IP4 0.0.0.0\r

17`,s+=`a=rtcp:9 IN IP4 0.0.0.0\r

18`,i.codecs.forEach(o=>{s+=e.writeRtpMap(o),s+=e.writeFmtp(o),s+=e.writeRtcpFb(o)});let r=0;return i.codecs.forEach(o=>{o.maxptime>r&&(r=o.maxptime)}),r>0&&(s+="a=maxptime:"+r+`\r

19`),i.headerExtensions&&i.headerExtensions.forEach(o=>{s+=e.writeExtmap(o)}),s},e.parseRtpEncodingParameters=function(t){const i=[],s=e.parseRtpParameters(t),r=s.fecMechanisms.indexOf("RED")!==-1,o=s.fecMechanisms.indexOf("ULPFEC")!==-1,a=

20`),t.mux&&(i+=`a=rtcp-mux\r

21`),t.ssrc!==void 0&&t.cname&&(i+="a=ssrc:"+t.ssrc+" cname:"+t.cname+`\r

22`),i},e.parseMsid=function(t){let i;const s=e.matchPrefix(t,"a=msid:");if(s.length===1)return i=s[0].substring(7).split(" "),{stream:i[0],track:i[1]};const r=e.matchPrefix(t,"a=ssrc:").map(o=>e.parseSsrcMedia(o)).filter(o=>o.attribute==="msid");if(r.length>0)return i=r[0].value.split(" "),{stream:i[0],track:i[1]}},e.parseSctpDescription=function(t){const i=e.parseMLine(t),s=e.matchPrefix(t,"a=max-message-size:");let r;s.length>0&&(r=parseInt(s[0].substring(19),10)),isNaN(r)&&(r=65536);const o=e.matchPrefix(t,"a=sctp-port:");if(o.length>0)return{port:parseInt(o[0].substring(12),10),protocol:i.f ...

23`,`c=IN IP4 0.0.0.0\r

24`,"a=sctp-port:"+i.port+`\r

25`]:s=["m="+t.kind+" 9 "+t.protocol+" "+i.port+`\r

26`,`c=IN IP4 0.0.0.0\r

27`,"a=sctpmap:"+i.port+" "+i.protocol+` 65535\r

28`],i.maxMessageSize!==void 0&&s.push("a=max-message-size:"+i.maxMessageSize+`\r

29`),s.join("")},e.generateSessionId=function(){return Math.random().toString().substr(2,22)},e.writeSessionBoilerplate=function(t,i,s){let r;const o=i!==void 0?i:2;return t?r=t:r=e.generateSessionId(),`v=0\r

30o=`+(s||"thisisadapterortc")+" "+r+" "+o+` IN IP4 127.0.0.1\r

31s=-\r

32t=0 0\r

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.umd.cjsView file

12patternName = generic_password severity = medium line = 12 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.umd.cjsView on unpkg · L12

Findings

4 Medium4 Low

MediumSecret Patterndist/index.umd.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

dist/index.umd.cjsView file

Lines 1-32javascript

2`:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[i++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2

3`).map(i=>i.trim())},e.splitSections=function(t){return t.split(`

4m=`).map((s,r)=>(r>0?"m="+s:s).trim()+`\r

6`},e.parseExtmap=function(t){const i=t.substring(9).split(" ");return{id:parseInt(i[0],10),direction:i[0].indexOf("/")>0?i[0].split

10`;return t.fingerprints.forEach(r=>{s+="a=fingerprint:"+r.algorithm+" "+r.value+`\r

11`}),s},e.parseCryptoLine=function(t){const i=t.substring(9).split(" ");return{tag:parseInt(i[0],10),cryptoSuite:i[1],keyParams:i[2],sessionParams:

12`},e.parseCryptoKeyParams=function(t){if(t.indexOf("inline:")!==0)return null;const i=t.substring(7).split("|");return{keyMethod:"inline",keySalt:i[0],lifeTime:i[1],mkiValue:i[2]

13a=ice-pwd:`+t.password+`\r

14`;return t.iceLite&&(i+=`a=ice-lite\r

16`,s+=`c=IN IP4 0.0.0.0\r

17`,s+=`a=rtcp:9 IN IP4 0.0.0.0\r

18`,i.codecs.forEach(o=>{s+=e.writeRtpMap(o),s+=e.writeFmtp(o),s+=e.writeRtcpFb(o)});let r=0;return i.codecs.forEach(o=>{o.maxptime>r&&(r=o.maxptime)}),r>0&&(s+="a=maxptime:"+r+`\r

20`),t.mux&&(i+=`a=rtcp-mux\r

21`),t.ssrc!==void 0&&t.cname&&(i+="a=ssrc:"+t.ssrc+" cname:"+t.cname+`\r

23`,`c=IN IP4 0.0.0.0\r

24`,"a=sctp-port:"+i.port+`\r

25`]:s=["m="+t.kind+" 9 "+t.protocol+" "+i.port+`\r

26`,`c=IN IP4 0.0.0.0\r

27`,"a=sctpmap:"+i.port+" "+i.protocol+` 65535\r

28`],i.maxMessageSize!==void 0&&s.push("a=max-message-size:"+i.maxMessageSize+`\r

30o=`+(s||"thisisadapterortc")+" "+r+" "+o+` IN IP4 127.0.0.1\r

31s=-\r

32t=0 0\r

Long lines were clipped for display.