registry / @brightcove/components-embed-code-modal / 1.0.8

@brightcove/components-embed-code-modal@1.0.8

Embed Code Modal used for publishing videos

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The source package's prepare lifecycle invokes Husky, which can install a Git pre-commit hook. Runtime behavior is a Brightcove embed-code UI using host-provided APIs; no malicious chain was confirmed.

Static reason

No blocking static signals were detected.

Trigger

Dependency lifecycle execution in a Git checkout; later user Git commits trigger the hook.

Impact

Modifies Git hook configuration and runs lint/test commands on commits; no confirmed data theft or remote code execution.

Mechanism

prepare-time VCS hook installation; user-invoked Brightcove player API calls

Rationale

This is not malicious, but the prepare lifecycle installs a VCS hook and therefore warrants a lifecycle-risk warning under policy. The hook behavior is package-aligned and no concrete malicious behavior was found.

Evidence

package.json.husky/pre-commitsrc/js/components/ModalContainer.tsxsrc/js/utils/call.tssrc/js/constants/baseUrls.tsscripts/create-dist-pkg-prod.jssrc/js/services/players-api.tssrc/js/services/url-shortener.tswebpack.config.jsetc/wildcard.brightcove.com.key

Network endpoints4

players.qa.brightcove.net/players.brightcove.net/

@brightcove/components-embed-code-modal@1.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code