registry / bloom-player / 2.20.2
bloom-player@2.20.2
A library for displaying Bloom books in iframes or WebViews
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no lifecycle hooks and points to the shared player library. The flagged bundle constructs and metadata are consistent with normal player behavior; no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The player loads analytics during normal browser use unless independent mode is disabled, and records reading events.
Impact
No malicious effect was established.
Mechanism
Analytics use the Bloom Library endpoint; the inspected code shows no unrelated credential transfer or install-time behavior.
AI rationale
The manifest has no lifecycle hooks and points to the shared player library. The flagged bundle constructs and metadata are consistent with normal player behavior; no malicious behavior was identified.
Evidence
package.jsonlib/shared.es.jsdist/bloomPlayer.8sVNsg8A.js
Network endpoints1
bloomlibrary.org
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports the shared library and contains no lifecycle script declarations.
- The shared library exports player functions for audio, narration, scrolling and activity cleanup.
- The bundle loads analytics from bloomlibrary.org and tracks player reading events.
- The flagged directional mark appears in a language-name entry.
- The flagged Function call is a fallback to obtain the global object.
Evidence against
Behavioral surface
EvalFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/bloomPlayer.8sVNsg8A.jsView file
27contains invisible/control Unicode U+200E (left-to-right mark)
abk ab Abkhazian аҧсуа бызшәа<U+200E> (Aṗsua byzšwa), аҧсшәа<U+200E> (Aṗsšwa)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/bloomPlayer.8sVNsg8A.jsView on unpkg · L277881L7882: Add a <Suspense fallback=...> component higher in the tree to provide a loading indicator or placeholder to display.`)}zn!==5&&(zn=2),W=Jc(W,z),Pt=A;do{switch(Pt.tag){case 3:C=W,Pt...
L7883: `):c)),h};var Vo=/^(?:focusinfocus|focusoutblur)$/,Go=function(c){c.stopPropagation()};v.extend(v.event,{trigger:function(c,h,m,w){var T,S,P,q,j,Z,ut,pt,at=[m||F],Et=E.call(c,"type...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/bloomPlayer.8sVNsg8A.jsView on unpkg · L78817s[t];e[n]=e.factory(n)}e.load=function(a,r){var l=document.createElement("script");l.type="text/javascript",l.async=!0,l.src=OS();var d=document.getElementsByTagName("script")[0];d.parentNode.insertBefore(l,d),e._loadOptions=r},e.SNIPPET_VERSION="4.1.0"}})();window.location.search.includes("independent=false")||(window.analytics.load(),window.onbeforeunload=DS);const Iu="bloom-player-read-duration",Am="bloom-player-book-url";function DS(){const e=Du.entries();let t=e.next();for(;!t.done;){const n=t.value[0],a=t.value[1];Rh(n,a),t=e.next()}return Du.clear(),localStorage.removeItem(Iu),null}func
Findings
1 Critical1 High1 Medium9 Low
CriticalTrojan Source Unicodedist/bloomPlayer.8sVNsg8A.js
HighPrevious Version Dangerous Deltalib/shared.es.js
MediumStructural Risk Force Deep Review
LowEvaldist/bloomPlayer.8sVNsg8A.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelib/shared.es.js
LowAi Review Evidencedist/bloomPlayer.8sVNsg8A.js
LowAi Review Evidencedist/bloomPlayer.8sVNsg8A.js
Affected versions and remediation
This report applies to bloom-player@2.20.2.
See all versions of bloom-player for other recorded verdicts.
- Review the evidence and your use of bloom-player@2.20.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.