registry / @ludeo/unit-player-infra-package / 1.34.0

@ludeo/unit-player-infra-package@1.34.0

Ludeo Unit Player Infra Example - Infrastructure package for game streaming and playable ads

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

NetworkWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryTrivialUrlStrings

Manifest

NoLicense

scanned 2 file(s), 600 KB of source, external domains: collector.ludeo.com, collector.stg.use1.ludeo.com, ghostpad-connections.ludeo.com, ghostpad-connections.stg.use1.ludeo.com, github.com, platform-assets.ludeo.com, platform-assets.stg.use1.ludeo.com, platform-translations.ludeo.com, services.ludeo.com, services.stg.use1.ludeo.com

Source & flagged code

4 flagged

package.jsonView file

Lines 24-64json

24 "private": false,

25 "type": "module",

26 "scripts": {

27 "dev": "vite",

28 "prod": "cross-env VITE_PROD_OVERRIDE=true concurrently --names \"vite ➡️,proxy ➡️\" --prefix-colors \"cyan,yellow\" \"vite\" \"npm run dev --prefix unit-proxy\"",

29 "dev:unit": "vite",

30 "build": "vite build",

31 "build:analyze": "vite build && npx vite-bundle-analyzer dist/unit-player.umd.js",

32 "build:cdn": "vite build && echo 'CDN files ready in dist/'",

33 "test": "vitest",

34 "test:run": "vitest run",

35 "test:watch": "vitest watch",

36 "test:coverage": "vitest run --coverage",

37 "test:coverage:watch": "vitest --coverage --watch",

38 "test:ui": "vitest --ui",

39 "test:related": "vitest related",

40 "test:changed": "vitest related --run",

41 "test:unit": "vitest run --reporter=verbose",

42 "test:ci": "vitest run --coverage --reporter=junit --outputFile=test-results.xml",

43 "release": "changeset publish",

44 "preinstall": "if [ \"$INIT_CWD\" = \"$PWD\" ]; then npx --no-install check-node-version --node 22.14.0; fi",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "prepare": "husky",

46 "build-fail-fast": "tsc --noEmit -p tsconfig.app.json",

47 "avoid-cyclic": "npx madge --circular --extensions js,jsx,ts,tsx src",

48 "lint": "eslint src --ext .ts,.tsx --max-warnings=0",

49 "lint:fix": "eslint src --ext .ts,.tsx --fix",

50 "commit-check": "concurrently -r --kill-others-on-fail \"npm run avoid-cyclic\" \"npm run build-fail-fast\" \"npm run lint\" \"npm run test:changed\"",

51 "preview": "vite preview --port 5001 --strictPort",

52 "e2e:local": "cross-env ENV=local npx playwright test || npx playwright show-report --port=9333",

53 "e2e:prod": "cross-env ENV=prod npx playwright test",

54 "e2e:headed": "cross-env ENV=local npx playwright test --headed --project=chromium",

55 "e2e:ci": "cross-env CI=true npx playwright test",

56 "format": "prettier --write \"src/**/*.{js,jsx,ts,tsx,json,css,scss,md}\""

57 },

58 "dependencies": {

59 "@ludeo/aws-gamecast-web-sdk": "^3.0.0",

60 "@ludeo/echo": "^1.1.3",

61 "@ludeo/ludeocast-client-sdk": "0.6.7",

62 "lodash": "^4.17.21",

63 "react": "19.1.0",

64 "react-dom": "19.1.0",

dist/unit-player.es.jsView file

Lines 1-5javascript

1var e,t,n,s,i,o,r,a,c,l,d,u,h,p,m,f,g,y,v,_,S,T,C,w=Object.defineProperty,b=e=>{throw TypeError(e)},E=(e,t,n)=>((e,t,n)=>t in e?

dist/unit-player.umd.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = if [ "$INIT_CWD" = "$PWD" ]; then npx --no-install check-node-version --node 22.14.0; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = if [ "$INIT_CWD" = "$PWD" ]; then npx --no-install check-node-version --node 22.14.0; fi

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/unit-player.es.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e,t,..._ */

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/unit-player.es.jsView on unpkg · L1

dist/unit-player.umd.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = !functio...)});

Medium

Secret Pattern

Hardcoded password in dist/unit-player.umd.js

dist/unit-player.umd.jsView on unpkg · L1

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/unit-player.es.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/unit-player.umd.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 24-64json

24 "private": false,

25 "type": "module",

26 "scripts": {

27 "dev": "vite",

28 "prod": "cross-env VITE_PROD_OVERRIDE=true concurrently --names \"vite ➡️,proxy ➡️\" --prefix-colors \"cyan,yellow\" \"vite\" \"npm run dev --prefix unit-proxy\"",

29 "dev:unit": "vite",

30 "build": "vite build",

31 "build:analyze": "vite build && npx vite-bundle-analyzer dist/unit-player.umd.js",

32 "build:cdn": "vite build && echo 'CDN files ready in dist/'",

33 "test": "vitest",

34 "test:run": "vitest run",

35 "test:watch": "vitest watch",

36 "test:coverage": "vitest run --coverage",

37 "test:coverage:watch": "vitest --coverage --watch",

38 "test:ui": "vitest --ui",

39 "test:related": "vitest related",

40 "test:changed": "vitest related --run",

41 "test:unit": "vitest run --reporter=verbose",

42 "test:ci": "vitest run --coverage --reporter=junit --outputFile=test-results.xml",

43 "release": "changeset publish",

44 "preinstall": "if [ \"$INIT_CWD\" = \"$PWD\" ]; then npx --no-install check-node-version --node 22.14.0; fi",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "prepare": "husky",

46 "build-fail-fast": "tsc --noEmit -p tsconfig.app.json",

47 "avoid-cyclic": "npx madge --circular --extensions js,jsx,ts,tsx src",

48 "lint": "eslint src --ext .ts,.tsx --max-warnings=0",

49 "lint:fix": "eslint src --ext .ts,.tsx --fix",

50 "commit-check": "concurrently -r --kill-others-on-fail \"npm run avoid-cyclic\" \"npm run build-fail-fast\" \"npm run lint\" \"npm run test:changed\"",

51 "preview": "vite preview --port 5001 --strictPort",

52 "e2e:local": "cross-env ENV=local npx playwright test || npx playwright show-report --port=9333",

53 "e2e:prod": "cross-env ENV=prod npx playwright test",

54 "e2e:headed": "cross-env ENV=local npx playwright test --headed --project=chromium",

55 "e2e:ci": "cross-env CI=true npx playwright test",

56 "format": "prettier --write \"src/**/*.{js,jsx,ts,tsx,json,css,scss,md}\""

57 },

58 "dependencies": {

59 "@ludeo/aws-gamecast-web-sdk": "^3.0.0",

60 "@ludeo/echo": "^1.1.3",

61 "@ludeo/ludeocast-client-sdk": "0.6.7",

62 "lodash": "^4.17.21",

63 "react": "19.1.0",

64 "react-dom": "19.1.0",

dist/unit-player.es.jsView file

Lines 1-5javascript

1var e,t,n,s,i,o,r,a,c,l,d,u,h,p,m,f,g,y,v,_,S,T,C,w=Object.defineProperty,b=e=>{throw TypeError(e)},E=(e,t,n)=>((e,t,n)=>t in e?

dist/unit-player.umd.jsView file

Lines 1-3javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis