registry / @simon-says-build/demo-player / 0.2.0
@simon-says-build/demo-player@0.2.0
SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection found no install hook or package-controlled credential recipient. The token is part of caller-supplied demo configuration and is sent to its configured demo API; interactive actions are viewer-invoked.
Static reason
No blocking static signals were detected.
Trigger
A host app supplies demo configuration and renders DemoHost; navigation or app handlers run when the viewer advances or selects an action.
Impact
No malicious effect was established; the reviewed behavior supports the demo-player function.
Mechanism
The player sends the demo token to the configured demo API and uses fetched steps to display guidance or invoke selected app handlers.
AI rationale
Source inspection found no install hook or package-controlled credential recipient. The token is part of caller-supplied demo configuration and is sent to its configured demo API; interactive actions are viewer-invoked.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines only a test script and no install lifecycle hook.
- The package entrypoint exports the demo player and helper APIs.
- Demo configuration requires an ID, token, and API URL supplied by the caller.
- The API sends the demo token to that configured API’s demo endpoint.
- Navigation and app handlers run through the viewer’s Next or “Do it for me” actions.
Evidence against
Behavioral surface
HighEntropyStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
23"scripts": {
"test": "node --test test/*.test.mjs"
},
"license": "UNLICENSED"
}
Low
Suspicious Lifecycle Evidence
The manifest defines only a test script and no install lifecycle hook.
package.jsonView on unpkg · L23index.jsView file
1export { DemoHost } from './src/DemoHost.js';
export { demoConfig, findTarget, handlerFor, phoneSteps, scalePoint, playDemo, currentDemo, onDemo } from './src/core.js';
Low
Ai Review Evidence
The package entrypoint exports the demo player and helper APIs.
index.jsView on unpkg · L1src/core.jsView file
105/** The demo this bundle carries (EXPO_PUBLIC_SSB_DEMO_*), or null when it carries none. */
export function demoConfig({ id, token, api, here } = {}) {
if (!id || !token || !api) return null;
return { id: String(id), token: String(token), api: String(api).replace(/\/+$/, ''), ...(here ? { here: true } : {}) };
}
// The card's box, inside the band between the insets
Findings
9 Low
LowScripts Present
LowHigh Entropy Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidencesrc/core.js
LowAi Review Evidencesrc/api.js
LowAi Review Evidencesrc/DemoHost.js
LowAi Review Evidencesrc/DemoHost.js
Affected versions and remediation
This report applies to @simon-says-build/demo-player@0.2.0.
See all versions of @simon-says-build/demo-player for other recorded verdicts.
- Review the evidence and your use of @simon-says-build/demo-player@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.