stream-chat@9.54.2
JS SDK for the Stream Chat API
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe runtime reporting is explicitly gated by the optional enableInsights setting, so the source does not show automatic credential exfiltration by default. However, the opted-in diagnostics include the user's chat token and profile details, which is excessive for operational insights and merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the application enables Insights and a websocket connection fails or recovers; HTTP warmup failures also trigger reporting.
Impact
If enabled, a session token and user information are disclosed to the vendor’s diagnostics service beyond ordinary operational metrics.
Mechanism
The SDK builds diagnostic payloads containing the chat token and user details, then posts them to the insights endpoint.
AI rationale
The runtime reporting is explicitly gated by the optional enableInsights setting, so the source does not show automatic credential exfiltration by default. However, the opted-in diagnostics include the user's chat token and profile details, which is excessive for operational insights and merits a warning.
Evidence
src/connection.tssrc/insights.tssrc/types.ts
Network endpoints1
chat-insights.getstream.io/insights/${insightType}
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When Insights are enabled, websocket failure and recovery paths send diagnostic payloads.
- The websocket diagnostic payload includes the chat token and user details.
- Diagnostics are posted to https://chat-insights.getstream.io/insights/${insightType}.
- Insights are gated by the optional enableInsights setting.
- The postinstall only imports scripts/install-husky.mjs if present; the package file allowlist contains only dist and src.
Evidence against
- Insights are opt-in through enableInsights and are sent on diagnostic events, not continuously.
- The insights endpoint belongs to Stream, the SDK vendor.
- The conditional Husky postinstall target is not included in the package file allowlist.
Behavioral surface
CryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node -e "require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "require('fs').existsSync('scripts/install-husky.mjs') && import('./scripts/install-husky.mjs')"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/connection.tsView file
356} catch (error: any) {
this.isConnecting = false;
this._log(`_connect() - Error - `, error);
if (this.client.options.enableInsights) {
this.client.insightMetrics.wsConsecutiveFailures++;
this.client.insightMetrics.wsTotalFailures++;
const insights = bui
Medium
Findings
1 Critical1 High5 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencesrc/connection.ts
MediumAi Review Evidencesrc/insights.ts
MediumAi Review Evidencesrc/insights.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to stream-chat@9.54.2.
See all versions of stream-chat for other recorded verdicts.
- Review the evidence and your use of stream-chat@9.54.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.