registry / @simon-says-build/demo-player / 0.7.0

@simon-says-build/demo-player@0.7.0

SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The flagged sign-in code serves the package’s stated guided-demo purpose and is limited to iOS sandbox demos. No install-time activity, unrelated credential collection, or automatic account actions outside that flow were found.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A host app renders DemoHost with demo configuration; sandbox sign-in begins when the loaded tour reaches a signin step.

Impact

Guides the viewer through a demo and can sign them into its sandbox account; no unrelated data collection or file writes were identified.

Mechanism

The player calls the configured demo API using its demo token, then opens the returned sign-in link through the app router or OS. Review actions require user interaction.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no install lifecycle hook; its entry point exports the player modules.
The README says the player renders nothing without demo configuration and documents the sign-in flow.
API requests use the configured demo API and demo token; the source contains no fixed collector host.
Automatic sign-in is limited to demos marked as iOS sandbox and not already running in the viewer’s build.
Sign-in runs on a `signin` tour step and opens the link returned by the demo API.
Approve and release requests are called from review actions.

Evidence against

A configured iOS sandbox demo automatically signs in each actor during its tour; this is documented behavior for the mobile demo player.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 8 file(s), 39.2 KB of source

Source & flagged code

7 flagged

src/signin.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @simon-says-build/demo-player@0.6.0 matchedIdentity = npm:[redacted]:0.6.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/signin.jsView on unpkg

36export const signsIn = (demo, { here = false } = {}) => !here && demo?.platform === 'ios' && demo?.backend === 'sandbox'; /** * Sign `actorIndex` in, then res

Low

Ai Review Evidence

Automatic sign-in is limited to demos marked as iOS sandbox and not already running in the viewer’s build.

src/signin.jsView on unpkg · L36

package.jsonView file

23"scripts": { "test": "node --test test/*.test.mjs" }, "license": "UNLICENSED" }

Findings

1 High9 Low

HighPrevious Version Dangerous Deltasrc/signin.js

LowScripts Present

LowHigh Entropy Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review EvidenceREADME.md

LowAi Review Evidencesrc/api.js

LowAi Review Evidencesrc/signin.js

LowAi Review Evidencesrc/DemoHost.js

Affected versions and remediation

This report applies to @simon-says-build/demo-player@0.7.0.

See all versions of @simon-says-build/demo-player for other recorded verdicts.

Review the evidence and your use of @simon-says-build/demo-player@0.7.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 14:59:53.398Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @simon-says-build/demo-player / 0.7.0

@simon-says-build/demo-player@0.7.0

SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A host app renders DemoHost with demo configuration; sandbox sign-in begins when the loaded tour reaches a signin step.

Impact

Guides the viewer through a demo and can sign them into its sandbox account; no unrelated data collection or file writes were identified.

Mechanism

The player calls the configured demo API using its demo token, then opens the returned sign-in link through the app router or OS. Review actions require user interaction.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no install lifecycle hook; its entry point exports the player modules.
The README says the player renders nothing without demo configuration and documents the sign-in flow.
API requests use the configured demo API and demo token; the source contains no fixed collector host.
Automatic sign-in is limited to demos marked as iOS sandbox and not already running in the viewer’s build.
Sign-in runs on a `signin` tour step and opens the link returned by the demo API.
Approve and release requests are called from review actions.

Evidence against

A configured iOS sandbox demo automatically signs in each actor during its tour; this is documented behavior for the mobile demo player.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 8 file(s), 39.2 KB of source

Source & flagged code

7 flagged

src/signin.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/signin.jsView on unpkg

36export const signsIn = (demo, { here = false } = {}) => !here && demo?.platform === 'ios' && demo?.backend === 'sandbox'; /** * Sign `actorIndex` in, then res

Low

Ai Review Evidence

Automatic sign-in is limited to demos marked as iOS sandbox and not already running in the viewer’s build.

src/signin.jsView on unpkg · L36

package.jsonView file

23"scripts": { "test": "node --test test/*.test.mjs" }, "license": "UNLICENSED" }

Findings

1 High9 Low

HighPrevious Version Dangerous Deltasrc/signin.js

LowScripts Present

LowHigh Entropy Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review EvidenceREADME.md

LowAi Review Evidencesrc/api.js

LowAi Review Evidencesrc/signin.js

LowAi Review Evidencesrc/DemoHost.js

Affected versions and remediation

This report applies to @simon-says-build/demo-player@0.7.0.

See all versions of @simon-says-build/demo-player for other recorded verdicts.

Review the evidence and your use of @simon-says-build/demo-player@0.7.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 14:59:53.398Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.