@simon-says-build/demo-player@0.6.0
SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source matches the package’s documented purpose: it loads a configured demo and, for an iOS sandbox demo, opens the app’s sign-in link as that demo is played. There is no install hook or evidence of unrelated data collection or account activity.
Decision evidence
public snapshot- The manifest has only a test script and no install lifecycle hook.
- A demo is disabled unless its ID, token, and API URL are supplied.
- The demo token is sent to the configured API at `/api/demo/:id/*`.
- Automatic sign-in is limited to iOS sandbox demos and runs when a sign-in step is reached; it opens the returned link in the app.
Source & flagged code
6 flaggedThe manifest has only a test script and no install lifecycle hook.
package.jsonView on unpkg · L23A demo is disabled unless its ID, token, and API URL are supplied.
src/core.jsView on unpkg · L112Findings
Affected versions and remediation
This report applies to @simon-says-build/demo-player@0.6.0.
See all versions of @simon-says-build/demo-player for other recorded verdicts.
- Review the evidence and your use of @simon-says-build/demo-player@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.