kasookoo-click-to-call-widget@0.1.0-beta.28
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package discloses runtime telemetry, but its automatic fetch instrumentation applies broadly to the host application and the fixed vendor collector has no disable or redirect option. This is an overbroad telemetry risk rather than evidence of credential theft or another malicious attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Widget.init, when the optional OpenTelemetry packages are available.
Impact
Traces can include activity from application fetch requests beyond the widget’s own requests; the vendor collector cannot be disabled or redirected.
Mechanism
Initializes a trace exporter to https://monitoring-test.kasookoo.ai/v1/traces and registers FetchInstrumentation with a match-all URL pattern.
AI rationale
The package discloses runtime telemetry, but its automatic fetch instrumentation applies broadly to the host application and the fixed vendor collector has no disable or redirect option. This is an overbroad telemetry risk rather than evidence of credential theft or another malicious attack.
Evidence
dist/index.jsREADME.md
Network endpoints2
monitoring-test.kasookoo.ai/v1/tracessdk-test.kasookoo.ai
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Widget.init starts telemetry automatically when the optional OpenTelemetry packages are available.
- Telemetry sends traces to a fixed Kasookoo collector even when the caller configures another endpoint.
- FetchInstrumentation is registered globally and propagates trace headers to URLs matching /.*/.
- The README says the vendor collector cannot be disabled or redirected.
Evidence against
- The README discloses telemetry and says it runs only when optional OpenTelemetry packages are installed.
- The package purpose involves backend requests and call diagnostics, which can reasonably generate widget telemetry.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/kasookoo-dialer.jsView file
1var Ur=i=>{throw TypeError(i)};var li=(i,e,t)=>e.has(i)||Ur("Cannot "+t);var en=(i,e,t)=>(li(i,e,"read from private field"),t?t.call(i):e.get(i)),tn=(i,e,t)=>e.has(i)?Ur("Cannot ad...
L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L112patternName = generic_password
severity = medium
line = 12
Medium
dist/index.jsView file
1874await initKasookooTelemetry(
{
endpoint: config2.telemetry?.endpoint,
logsEndpoint: config2.telemetry?.logsEndpoint,
serviceName: config2.telemetry?.serviceName,
environment: config2.telemetry?.environme
Findings
1 High6 Medium5 Low
HighSame File Env Network Executiondist/kasookoo-dialer.js
MediumSecret Patterndist/kasookoo-dialer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.28.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.