kasookoo-click-to-call-widget@0.1.0-beta.29
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package's documented telemetry exports identifying call details, including phone numbers and user IDs, to a mandatory Kasookoo collector. The collection is disclosed and depends on optional OpenTelemetry packages, but users have no way to disable or redirect that collector, so this warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
An application initializes the widget with OpenTelemetry packages installed and places a call.
Impact
Kasookoo receives identifying call details through telemetry; this collection is documented, but the call number is not described as a telemetry field.
Mechanism
The widget exports traces to a fixed Kasookoo endpoint and includes the phone number and user ID in the SIP call span. The collector cannot be disabled or redirected.
AI rationale
The package's documented telemetry exports identifying call details, including phone numbers and user IDs, to a mandatory Kasookoo collector. The collection is disclosed and depends on optional OpenTelemetry packages, but users have no way to disable or redirect that collector, so this warrants a warning.
Evidence
dist/index.jsREADME.md
Network endpoints2
monitoring-test.kasookoo.ai/v1/tracesmonitoring-test.kasookoo.ai/v1/logs
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The README says telemetry starts when optional OpenTelemetry packages are installed and sends widget logs and traces to Kasookoo.
- Widget initialization automatically starts telemetry and passes through configuration for additional endpoints.
- The trace exporter always includes https://monitoring-test.kasookoo.ai/v1/traces as its first endpoint.
- A SIP call span records the phone number and user ID, and is exported with the call traces.
- The README says Kasookoo's collector always receives telemetry and it cannot be turned off or redirected.
Evidence against
- The package is a click-to-call widget, and its API requests use the supplied session token for call operations.
- Telemetry is documented and only starts when optional OpenTelemetry packages are installed.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/kasookoo-dialer.jsView file
1var Fr=i=>{throw TypeError(i)};var li=(i,e,t)=>e.has(i)||Fr("Cannot "+t);var en=(i,e,t)=>(li(i,e,"read from private field"),t?t.call(i):e.get(i)),tn=(i,e,t)=>e.has(i)?Fr("Cannot ad...
L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L112patternName = generic_password
severity = medium
line = 12
Medium
README.mdView file
462## OpenTelemetry
The widget reports its own logs and traces to Kasookoo so integration problems can be diagnosed. This starts automatically when the optional OpenTelemetry packages are installed, and does nothing when they aren't. It never affects calling.
```bash
npm install @opentelemetry/api @opentelemetry/sdk-trace-web @opentelemetry/sdk-trace-base \
@opentelemetry/exporter-trace-otlp-http @opentelemetry/instrumentation \
@opentelemetry/instrumentation-fetch @opentelemetry/resources \
@opentelemetry/semantic-conventions @opentelemetry/sdk-logs \
@ope
Findings
1 High6 Medium5 Low
HighSame File Env Network Executiondist/kasookoo-dialer.js
MediumSecret Patterndist/kasookoo-dialer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review EvidenceREADME.md
MediumAi Review Evidencedist/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.29.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.