@simon-says-build/demo-player@0.8.0
SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source matches the stated purpose of a mobile demo player. Its network calls use the supplied demo API and token, and the event helper is invoked as part of a loaded tour rather than by an install or import hook.
Decision evidence
public snapshot- The package has no install lifecycle hook; its manifest exposes index.js and only declares a test script.
- The event helper POSTs the actor index, helper name, and arguments to the configured demo API.
- An event runs only when a loaded demo tour reaches an event step; runtime demo playback is explicitly started with playDemo.
- The README says the player renders nothing without the demo ID, token, and API configuration.
Source & flagged code
4 flaggedThe package has no install lifecycle hook; its manifest exposes index.js and only declares a test script.
package.jsonView on unpkg · L1The event helper POSTs the actor index, helper name, and arguments to the configured demo API.
src/api.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to @simon-says-build/demo-player@0.8.0.
See all versions of @simon-says-build/demo-player for other recorded verdicts.
- Review the evidence and your use of @simon-says-build/demo-player@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.