kasookoo-click-to-call-widget@0.1.0-beta.23
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe runtime automatically routes call-related identifiers to a fixed test-domain telemetry endpoint when optional OpenTelemetry integrations are present. The endpoint is on the vendor’s domain and the source does not establish its operator or downstream use, so warn about the data exposure without blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer initializes the widget and has the optional OpenTelemetry integrations available; placing a call produces the identifying call data.
Impact
Call-related personal data may be disclosed to the package’s test-domain collector; source does not establish downstream access or use.
Mechanism
Telemetry initialization sends traces to the fixed collector even when the caller supplies another endpoint. The call path adds the phone number and optional user ID to spans and logs.
AI rationale
The runtime automatically routes call-related identifiers to a fixed test-domain telemetry endpoint when optional OpenTelemetry integrations are present. The endpoint is on the vendor’s domain and the source does not establish its operator or downstream use, so warn about the data exposure without blocking publication.
Evidence
package.jsondist/index.cjsdist/index.jsdist/kasookoo-dialer.js
Network endpoints1
monitoring-test.kasookoo.ai/v1/traces
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json routes package imports through dist/index.js or dist/index.cjs and marks OpenTelemetry peer integrations optional.
- The runtime always includes https://monitoring-test.kasookoo.ai/v1/traces in its trace destinations; configured trace endpoints are added alongside it.
- Widget initialization invokes telemetry setup with caller configuration, without a setting that removes the mandatory trace destination.
- The call path records the destination phone number and optional user ID in spans and logs.
- The dialer bundle repeats the mandatory collector and call-data behavior; telemetry is conditional on the optional OpenTelemetry integrations being available.
Evidence against
- The collector is on the Kasookoo domain and call telemetry is related to the widget’s calling function; source does not establish who operates the test collector or how exported data is used.
- Telemetry setup requires widget initialization and available optional OpenTelemetry integrations; the inspected source does not establish that telemetry runs in every consumer environment.
Behavioral surface
Source & flagged code
6 flaggeddist/kasookoo-dialer.jsView file
1var Lr=i=>{throw TypeError(i)};var di=(i,e,t)=>e.has(i)||Lr("Cannot "+t);var en=(i,e,t)=>(di(i,e,"read from private field"),t?t.call(i):e.get(i)),tn=(i,e,t)=>e.has(i)?Lr("Cannot ad...
L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L112patternName = generic_password
severity = medium
line = 12
Medium
package.jsonView file
6"main": "./dist/index.cjs",
"module": "./dist/index.js",
"types": "
Findings
1 High7 Medium4 Low
HighSame File Env Network Executiondist/kasookoo-dialer.js
MediumSecret Patterndist/kasookoo-dialer.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.cjs
MediumAi Review Evidencedist/index.cjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.23.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.