video-sdk-web

The code appears to be legitimate Zoom Video SDK application code and shows no clear malware or intentional sabotage. The significant security concern is bearer-token exposure: JWTs are accepted from URL parameters, logged in full, and persisted in browser history and shareable URLs. Tokens should be passed through a protected mechanism such as a server-side session or short-lived fragment handling, never logged, and removed from the address bar immediately. The hardcoded plain-HTTP localhost token endpoint should also be configuration-driven and secured for non-development use.

The code is a legitimate Zoom Video SDK Nuxt integration example and contains no apparent malware or supply-chain backdoor. The principal security issue is the unauthenticated token endpoint, which allows arbitrary callers to obtain host tokens for client-supplied session names; it should be protected by application authentication and authorization, with role and topic derived server-side. URL encoding and awaited SDK initialization should also be improved. Findings are based only on the supplied fragment.