@vonage/client-sdk
The Client SDK is intended to provide a ready solution for developers to build Programmable Conversation applications across multiple Channels including: Messages, Voice, SIP, websockets, and App.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/client/index.cjs | AI (source-diff): Encoded strings are Kotlin/JS compiled Unicode range tables (decodeVarLenBase64 pattern), not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:dist/vonageClientSDK.js | AI (source-diff): Same Kotlin/JS compiled Unicode range table pattern; benign for this package. | ai | |
| source-diff | encoded-string-file:dist/vonageClientSDK.min.js | AI (source-diff): Minified bundle of Kotlin/JS output; encoded strings are Unicode range tables. | ai | |
| source-diff | encoded-string-file:dist/client/index.mjs | AI (source-diff): Same Kotlin/JS compiled Unicode range table pattern; benign for this package. | ai | |
| source-diff | encoded-string-file:dist/vonageClientSDK.min.mjs | AI (source-diff): Minified ESM bundle of Kotlin/JS output; encoded strings are Unicode range tables. | ai | |
| source-diff | encoded-string-file:dist/vonageClientSDK.mjs | AI (source-diff): Same Kotlin/JS compiled Unicode range table pattern; benign for this package. | ai | |
| phantom-deps | phantom-dep:socketio-wildcard | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:events | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:typedoc-plugin-missing-exports | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:sdp-transform | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:webrtc-adapter | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:socket.io-client | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@js-joda/timezone | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai | |
| phantom-deps | phantom-dep:rtc-stats-adapter | AI (phantom-deps): Bundled rollup build; deps referenced in config not directly imported in source. | ai |
v2.4.0
7 findingsModified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.