kasookoo-click-to-call-widget@0.1.0-beta.22
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe package automatically exports dialed phone numbers and user IDs to its Kasookoo monitoring service when optional OpenTelemetry packages are present, creating a real but package-aligned privacy risk. No install-time attack or credential disclosure to the call-intent endpoint was established, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Widget initialization starts telemetry; placing an outbound call creates the identifying log entries.
Impact
Call and user identifiers are disclosed to the package vendor's monitoring service without a per-consumer telemetry opt-in.
Mechanism
The package exports call logs to a logs endpoint derived from its fixed traces endpoint, even when another telemetry endpoint is configured.
AI rationale
The package automatically exports dialed phone numbers and user IDs to its Kasookoo monitoring service when optional OpenTelemetry packages are present, creating a real but package-aligned privacy risk. No install-time attack or credential disclosure to the call-intent endpoint was established, so this warrants a warning rather than a block.
Evidence
package.jsondist/index.cjsdist/index.jsdist/kasookoo-dialer.js
Network endpoints2
monitoring-test.kasookoo.ai/v1/tracesmonitoring-test.kasookoo.ai/v1/logs
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest describes an outbound calling widget and lists only build, development, and type-check scripts; no install lifecycle script is present.
- Session and call requests use the configured Kasookoo base URL. The separate call-intent request sends the phone number and subject, or a caller-provided body, to the configured intent endpoint.
- Widget initialization starts telemetry with a fixed Kasookoo monitoring endpoint; configuring another endpoint supplements that destination. The logs endpoint is derived from the fixed traces endpoint.
- Call logs include the dialed phone number and user ID, and the telemetry log sink exports log attributes. The browser dialer bundle contains the same call logging and automatic telemetry setup.
- The OpenTelemetry packages are optional peers, so telemetry export depends on the consumer having those packages available; the collector is Kasookoo-branded.
Evidence against
- The manifest contains no install hook, and the inspected credential callers route session tokens to configured-base-URL session or call APIs rather than the call-intent endpoint.
- The telemetry destination is package-aligned, and its OpenTelemetry dependencies are optional; the source does not establish credential theft or a malicious install-time action.
Source & flagged code
6 flaggeddist/kasookoo-dialer.jsView file
1var Lr=i=>{throw TypeError(i)};var di=(i,e,t)=>e.has(i)||Lr("Cannot "+t);var en=(i,e,t)=>(di(i,e,"read from private field"),t?t.call(i):e.get(i)),tn=(i,e,t)=>e.has(i)?Lr("Cannot ad...
L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L112patternName = generic_password
severity = medium
line = 12
Medium
package.jsonView file
2"name": "kasookoo-click-to-call-widget",
"version": "0.1.0-beta.22",
"description": "Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.",
"type": "modul
Findings
1 High7 Medium4 Low
HighSame File Env Network Executiondist/kasookoo-dialer.js
MediumSecret Patterndist/kasookoo-dialer.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.cjs
MediumAi Review Evidencedist/index.cjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.22.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.