registry / Telemetry / @simon-says-build/demo-player / 0.9.0

@simon-says-build/demo-player@0.9.0

SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The rescue feature sends selected screen text to the configured service automatically when a tour target is missing. This is relevant to the demo player’s function, but the transfer can include user-visible information and has no separate confirmation, so it warrants a warning.

Static reason

No blocking static signals were detected.

Trigger

A tour target remains unavailable beyond the search period, and that step has not already requested rescue.

Impact

Visible app text may include user or account information; the transfer occurs without a separate confirmation when rescue is triggered.

Mechanism

It builds a bounded list of screen candidates and posts them with actor and step indices to the repair endpoint, authenticated with the demo token.

AI rationale

Evidence

src/DemoHost.jssrc/core.jssrc/api.js

Network endpoints2

${api}/api/demo/:id/repair${api}/api/demo/:id/repair/:repairId

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

If a tour target remains missing past the wait period, the player automatically requests a rescue once for that step.
The rescue request includes the current screen candidates along with the actor and step indices.
Candidates can contain accessibility labels and visible text from the app’s screen.
The request is POSTed to the configured demo API’s repair endpoint using the demo token.

Evidence against

The manifest declares no install, preinstall, or postinstall hook.
The screen capture is limited to candidate labels and short visible text for the demo’s target-repair feature; no unrelated host is hard-coded.
Review and release actions are initiated by user-facing buttons.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 10 file(s), 51.4 KB of source

Source & flagged code

6 flagged

src/DemoHost.jsView file

142Date.now() - started > FIND_FOR_MS && !rescue) askRescue(step, index); }; tick(); const t = setInterval(tick, TRACK_EV

Medium

Ai Review Evidence

If a tour target remains missing past the wait period, the player automatically requests a rescue once for that step.

src/DemoHost.jsView on unpkg · L142

108api.repair({ actorIndex: at.actorIndex, stepIndex: at.stepIndex, candidates: screenCandidates(fiberOf(rootRef.current)) }); for (let i = 0; r.status === 'pending' || r.status

Medium

Ai Review Evidence

The rescue request includes the current screen candidates along with the actor and step indices.

src/DemoHost.jsView on unpkg · L108

src/core.jsView file

117xt: text.slice(0, 200) } : {}) }); }; for (const f of walk(root, (h) => h.memoizedProps?.testID === OVERLAY_ID)) { if (out.length >= max) break; const p = f.memoizedProps || {}; if (f.tag === HOST && (p.testID || p.accessibilityLabel)) { const label = String(p.accessibilityLabel || p['ar

Findings

6 Medium3 Low

MediumAi Review Evidencesrc/DemoHost.js

MediumAi Review Evidencesrc/core.js

MediumAi Review Evidencesrc/api.js

LowScripts Present

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to @simon-says-build/demo-player@0.9.0.

See all versions of @simon-says-build/demo-player for other recorded verdicts.

Review the evidence and your use of @simon-says-build/demo-player@0.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 19:15:38.854Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / @simon-says-build/demo-player / 0.9.0

@simon-says-build/demo-player@0.9.0

SimonSays mobile demo player: walks a preview's viewer through a job's change, inside the app. Renders nothing unless the bundle carries a demo.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

A tour target remains unavailable beyond the search period, and that step has not already requested rescue.

Impact

Visible app text may include user or account information; the transfer occurs without a separate confirmation when rescue is triggered.

Mechanism

It builds a bounded list of screen candidates and posts them with actor and step indices to the repair endpoint, authenticated with the demo token.

AI rationale

Evidence

src/DemoHost.jssrc/core.jssrc/api.js

Network endpoints2

${api}/api/demo/:id/repair${api}/api/demo/:id/repair/:repairId

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

If a tour target remains missing past the wait period, the player automatically requests a rescue once for that step.
The rescue request includes the current screen candidates along with the actor and step indices.
Candidates can contain accessibility labels and visible text from the app’s screen.
The request is POSTed to the configured demo API’s repair endpoint using the demo token.

Evidence against

The manifest declares no install, preinstall, or postinstall hook.
The screen capture is limited to candidate labels and short visible text for the demo’s target-repair feature; no unrelated host is hard-coded.
Review and release actions are initiated by user-facing buttons.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 10 file(s), 51.4 KB of source

Source & flagged code

6 flagged

src/DemoHost.jsView file

142Date.now() - started > FIND_FOR_MS && !rescue) askRescue(step, index); }; tick(); const t = setInterval(tick, TRACK_EV

Medium

Ai Review Evidence

If a tour target remains missing past the wait period, the player automatically requests a rescue once for that step.

src/DemoHost.jsView on unpkg · L142

108api.repair({ actorIndex: at.actorIndex, stepIndex: at.stepIndex, candidates: screenCandidates(fiberOf(rootRef.current)) }); for (let i = 0; r.status === 'pending' || r.status

Medium

Ai Review Evidence

The rescue request includes the current screen candidates along with the actor and step indices.

src/DemoHost.jsView on unpkg · L108

src/core.jsView file

Findings

6 Medium3 Low

MediumAi Review Evidencesrc/DemoHost.js

MediumAi Review Evidencesrc/core.js

MediumAi Review Evidencesrc/api.js

LowScripts Present

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to @simon-says-build/demo-player@0.9.0.

See all versions of @simon-says-build/demo-player for other recorded verdicts.

Review the evidence and your use of @simon-says-build/demo-player@0.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 19:15:38.854Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.