@simon-says-build/demo-player@0.4.0
SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected entrypoint and source implement a configured mobile demo player, with no install hook or concrete attack behavior found. Its API requests use the supplied demo configuration, and review or release actions are user-triggered.
Decision evidence
public snapshot- package.json declares index.js as the entrypoint and has no install lifecycle hook; index.js re-exports the player API.
- src/api.js sends the demo token to the API supplied in the demo configuration.
- src/DemoHost.js loads demo data when the configured player runs.
- Review, approval, and release requests are tied to review-card button actions.
Source & flagged code
7 flaggedpackage.json declares index.js as the entrypoint and has no install lifecycle hook; index.js re-exports the player API.
package.jsonView on unpkg · L1package.json declares index.js as the entrypoint and has no install lifecycle hook; index.js re-exports the player API.
index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @simon-says-build/demo-player@0.4.0.
See all versions of @simon-says-build/demo-player for other recorded verdicts.
- Review the evidence and your use of @simon-says-build/demo-player@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.