registry / Credential exfiltration / kasookoo-click-to-call-widget / 0.1.0-beta.13

kasookoo-click-to-call-widget@0.1.0-beta.13

Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source inspection establishes conditional forwarding of an existing service credential to an unrestricted configured destination. This warrants a warning under the credential-forwarding policy, while the scanner's environment signal does not establish malware.

Static reason

One or more suspicious static signals were detected.

Trigger

Initialize with a changed baseUrl while a valid session cookie for the same subject exists, then perform authenticated activity or destroy the widget.

Impact

The configured recipient could receive an existing service session token.

Mechanism

Session restoration omits destination binding; teardown uses the new baseUrl and sends the restored token as a bearer credential.

AI rationale

Evidence

dist/index.js

Network endpoints1

sdk-test.kasookoo.ai

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Cached session restoration checks subject and expiry but does not bind the token to its original API destination.
Widget initialization accepts a configurable API destination and starts the session manager with it.
Session teardown forwards the restored token to the configured destination through an authenticated DELETE request.
The HTTP helper sends supplied tokens in the Authorization header.
package.json has no automatic installation lifecycle hooks.
The flagged dialer environment access controls BigInt support rather than harvesting environment secrets.

Evidence against

Default API and telemetry destinations belong to Kasookoo.
Exposure requires a valid cached session, a changed API destination, initialization and subsequent authenticated activity; no covert attacker destination was identified.

Behavioral surface

Source

EnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

6 flagged

dist/kasookoo-dialer.jsView file

1var xr=i=>{throw TypeError(i)};var ri=(i,e,t)=>e.has(i)||xr("Cannot "+t);var Qt=(i,e,t)=>(ri(i,e,"read from private field"),t?t.call(i):e.get(i)),Xt=(i,e,t)=>e.has(i)?xr("Cannot ad... L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/kasookoo-dialer.jsView on unpkg · L1

12patternName = generic_password severity = medium line = 12

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/kasookoo-dialer.jsView on unpkg · L12

1typeof process!="object"||typeof process.env!="object"||process.env.BUF_BIGINT_DISABLE!=="1")){let s=BigInt

Medium

Ai Review Evidence

The flagged dialer environment access controls BigInt support rather than harvesting environment secrets.

Findings

1 High7 Medium4 Low

HighSame File Env Network Executiondist/kasookoo-dialer.js

MediumSecret Patterndist/kasookoo-dialer.js

MediumNetwork

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/kasookoo-dialer.js

MediumAi Review Evidencedist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to kasookoo-click-to-call-widget@0.1.0-beta.13.

See all versions of kasookoo-click-to-call-widget for other recorded verdicts.

Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-04 10:17:09.455Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Credential exfiltration / kasookoo-click-to-call-widget / 0.1.0-beta.13

kasookoo-click-to-call-widget@0.1.0-beta.13

Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

Initialize with a changed baseUrl while a valid session cookie for the same subject exists, then perform authenticated activity or destroy the widget.

Impact

The configured recipient could receive an existing service session token.

Mechanism

Session restoration omits destination binding; teardown uses the new baseUrl and sends the restored token as a bearer credential.

AI rationale

Evidence

dist/index.js

Network endpoints1

sdk-test.kasookoo.ai

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Cached session restoration checks subject and expiry but does not bind the token to its original API destination.
Widget initialization accepts a configurable API destination and starts the session manager with it.
Session teardown forwards the restored token to the configured destination through an authenticated DELETE request.
The HTTP helper sends supplied tokens in the Authorization header.
package.json has no automatic installation lifecycle hooks.
The flagged dialer environment access controls BigInt support rather than harvesting environment secrets.

Evidence against

Default API and telemetry destinations belong to Kasookoo.
Exposure requires a valid cached session, a changed API destination, initialization and subsequent authenticated activity; no covert attacker destination was identified.

Behavioral surface

Source

EnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

6 flagged

dist/kasookoo-dialer.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/kasookoo-dialer.jsView on unpkg · L1

12patternName = generic_password severity = medium line = 12

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/kasookoo-dialer.jsView on unpkg · L12

1typeof process!="object"||typeof process.env!="object"||process.env.BUF_BIGINT_DISABLE!=="1")){let s=BigInt

Medium

Ai Review Evidence

The flagged dialer environment access controls BigInt support rather than harvesting environment secrets.

Findings

1 High7 Medium4 Low

HighSame File Env Network Executiondist/kasookoo-dialer.js

MediumSecret Patterndist/kasookoo-dialer.js

MediumNetwork

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/kasookoo-dialer.js

MediumAi Review Evidencedist/index.js

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to kasookoo-click-to-call-widget@0.1.0-beta.13.

See all versions of kasookoo-click-to-call-widget for other recorded verdicts.

Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-04 10:17:09.455Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.