registry / bloom-player / 2.20.1
bloom-player@2.20.1
A library for displaying Bloom books in iframes or WebViews
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a browser-oriented Bloom player with audio/activity assets and bundled frontend libraries, with no install-time execution, shell/native loading, credential harvesting, or AI-agent control-surface mutation. Scanner hits map to benign bundled code, valid media assets, and package-aligned browser resource loading.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
user imports library or opens dist/bloomplayer.htm in a browser/WebView
Impact
normal Bloom book rendering and audio/activity playback
Mechanism
browser DOM/audio player and bundled UI code
AI rationale
Static inspection shows a browser-oriented Bloom player with audio/activity assets and bundled frontend libraries, with no install-time execution, shell/native loading, credential harvesting, or AI-agent control-surface mutation. Scanner hits map to benign bundled code, valid media assets, and package-aligned browser resource loading.
Evidence
package.jsonsrc/shared/narration.tssrc/shared/dragActivityRuntime.tslib/shared.es.jsdist/bloomPlayer.CzxSC7ao.jsdist/right_answer-XEe3HakR.mp3dist/wrong_answer-BhCi5k6f.mp3
Network endpoints6
bloomlibrary.org/analytics.dev.min.jsbloomlibrary.org/analytics.min.jsbloomlibrary.org/analytics.test.min.jsbloomlibrary.org/fonts/Andika%20New%20Basic/AndikaNewBasic-B.woffbloomlibrary.org/fonts/Andika/Andika-Regular.woffcdnjs.cloudflare.com/ajax/libs/slider-pro/1.3.0/css/images/openhand.cur
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no lifecycle scripts or bin; export is lib/shared.es.js.
- src/shared/narration.ts only creates/loads audio elements from urlPrefix()/audio/<id>.mp3 for Bloom playback.
- src/shared/dragActivityRuntime.ts uses bundled MP3 defaults and page attributes for activity sounds; no shell or filesystem APIs.
- Bidi/invisible Unicode scan over package source returned no matches despite scanner hint.
- MP3 files are valid MPEG audio assets, not executable payloads.
- Network URLs in dist are Bloom/player docs, fonts, analytics, and bundled library references; no credential harvesting or exfiltration code found.
Behavioral surface
ChildProcessDynamicRequireEvalFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/bloomPlayer.CzxSC7ao.jsView file
27contains invisible/control Unicode U+200E (left-to-right mark)
abk ab Abkhazian аҧсуа бызшәа<U+200E> (Aṗsua byzšwa), аҧсшәа<U+200E> (Aṗsšwa)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/bloomPlayer.CzxSC7ao.jsView on unpkg · L277881L7882: Add a <Suspense fallback=...> component higher in the tree to provide a loading indicator or placeholder to display.`)}In!==5&&(In=2),_=Yc(_,I),Pt=A;do{switch(Pt.tag){case 3:C=_,Pt...
L7883: `):c)),h};var Vo=/^(?:focusinfocus|focusoutblur)$/,Go=function(c){c.stopPropagation()};v.extend(v.event,{trigger:function(c,h,m,w){var T,S,E,q,j,Z,ut,pt,at=[m||F],Et=P.call(c,"type...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/bloomPlayer.CzxSC7ao.jsView on unpkg · L78817881L7882: Add a <Suspense fallback=...> component higher in the tree to provide a loading indicator or placeholder to display.`)}In!==5&&(In=2),_=Yc(_,I),Pt=A;do{switch(Pt.tag){case 3:C=_,Pt...
L7883: `):c)),h};var Vo=/^(?:focusinfocus|focusoutblur)$/,Go=function(c){c.stopPropagation()};v.extend(v.event,{trigger:function(c,h,m,w){var T,S,E,q,j,Z,ut,pt,at=[m||F],Et=P.call(c,"type...
Findings
1 Critical1 High2 Medium4 Low
CriticalTrojan Source Unicodedist/bloomPlayer.CzxSC7ao.js
HighShips High Entropy Blobdist/wrong_answer-BhCi5k6f.mp3
MediumDynamic Requiredist/bloomPlayer.CzxSC7ao.js
MediumStructural Risk Force Deep Review
LowEvaldist/bloomPlayer.CzxSC7ao.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to bloom-player@2.20.1.
See all versions of bloom-player for other recorded verdicts.
- Review the evidence and your use of bloom-player@2.20.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.