kasookoo-click-to-call-widget@0.1.0-beta.25
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe manifest's publish hook runs the build, while session and call requests use the configured Kasookoo API routes. Call-intent transport is configured by the integrator, and the bundled dialer's environment and fetch references are consistent with its runtime functions.
Decision evidence
public snapshot- package.json exposes the CJS and ESM bundles; its prepublishOnly command runs the build.
- Session and call tokens are sent to configured Kasookoo API routes. Call-intent requests use the configured endpoint and its supplied headers and credentials; the returned intent is used for the Kasookoo call request.
- The bundled dialer uses fetch for SDK requests with optional authorization headers; its environment check reads BUF_BIGINT_DISABLE.
- Tracing uses the Kasookoo monitoring host, and configured client trace endpoints can be added.
Source & flagged code
4 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.25.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.