This message was deleted.

hmm. yeah that’s not great. Looks like they’re just trying to get around a code scanner that disallows

require

. On the other hand, since the code being executed is actually just obfuscation to generate a hardcoded

"require"

, I don’t think there’s a real security risk — there’s no other possible values that this code might pass to

eval

except

"require"

. Anyways, I’ve added an internal ticket to look into this, thanks for pointing it out!

@best-parrot-43500 which version of livekit-sdk are you using? We removed the dependency on protobufjs awhile ago. The latest release does not include that package in our yarn.lock

out of curiosity what was the source of this issue being flagged on your product?

We had a customer that disabled

eval

via CSP and the call integration broke 😄