@simon-says-build/demo-player@0.3.0
SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected runtime sends a caller-provided demo token to the caller-provided API for demo operations. Approval and discussion require user interaction, so no concrete attack surface was identified.
Decision evidence
public snapshot- package.json declares index.js as its entrypoint and only a test script; it has no install lifecycle script.
- demoConfig requires the caller to provide an ID, token, and API endpoint.
- The API client sends the supplied demo token to that supplied API under the demo route.
- The player loads demo data through that API when its effect runs.
- Approval and discussion requests are wired to explicit review buttons.
Source & flagged code
7 flaggedpackage.json declares index.js as its entrypoint and only a test script; it has no install lifecycle script.
package.jsonView on unpkg · L10package.json declares index.js as its entrypoint and only a test script; it has no install lifecycle script.
package.jsonView on unpkg · L23Findings
Affected versions and remediation
This report applies to @simon-says-build/demo-player@0.3.0.
See all versions of @simon-says-build/demo-player for other recorded verdicts.
- Review the evidence and your use of @simon-says-build/demo-player@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.