kasookoo-click-to-call-widget@0.1.0-beta.15
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source supports a warning for conditional forwarding of an existing service credential to an unrestricted configured destination. The scanner's environment signal is ordinary bundled functionality, and no block-eligible attack was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Initialize with a different baseUrl while a valid session cookie for the same subject exists, then invoke authenticated operations or session closure.
Impact
An alternate endpoint could receive an existing Kasookoo session token if the browser permits the request.
Mechanism
Cookie restoration does not check the issuing destination; requests attach the restored token as bearer authentication to the configured base URL.
AI rationale
The source supports a warning for conditional forwarding of an existing service credential to an unrestricted configured destination. The scanner's environment signal is ordinary bundled functionality, and no block-eligible attack was established.
Evidence
dist/index.js
Network endpoints1
sdk-test.kasookoo.ai
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has build scripts but no automatic install lifecycle hooks.
- Session restoration accepts a saved cookie token based on subject and expiry without binding it to the original API destination.
- The API base URL accepts a caller-configured value without a destination allowlist.
- Session closure sends the restored token as bearer authentication to the configured API destination.
- Explicit widget initialization starts session restoration and supplies its token to call handling.
- The flagged dialer environment access controls bundled BigInt support.
Evidence against
- The default API and monitoring destinations belong to Kasookoo.
- No covert recipient, shell execution, or malicious install behavior was identified.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/kasookoo-dialer.jsView file
1var xr=i=>{throw TypeError(i)};var ri=(i,e,t)=>e.has(i)||xr("Cannot "+t);var Qt=(i,e,t)=>(ri(i,e,"read from private field"),t?t.call(i):e.get(i)),Xt=(i,e,t)=>e.has(i)?xr("Cannot ad...
L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L112patternName = generic_password
severity = medium
line = 12
Medium
package.jsonView file
24"scripts": {
"build": "tsup",
"dev": "tsup --watch",
"typecheck": "tsc --noEmit"
},
"keyword
Findings
1 High7 Medium4 Low
HighSame File Env Network Executiondist/kasookoo-dialer.js
MediumSecret Patterndist/kasookoo-dialer.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.15.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.