bloom-player@2.22.0
A library for displaying Bloom books in iframes or WebViews
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe bundle automatically loads BloomLibrary analytics and reports book metadata and reading activity without a clear disclosure in the package manifest. This is suspicious runtime telemetry, but the inspected code does not show credential theft or unrelated data collection.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
When the player starts and when a book is opened or reading activity is reported; analytics is skipped only when the URL contains `independent=false`.
Impact
BloomLibrary analytics receives details about the book and the reader's activity. No credential or local file collection was identified.
Mechanism
The bundle loads BloomLibrary's analytics script and tracks book-open and reading events with book metadata and progress metrics.
AI rationale
The bundle automatically loads BloomLibrary analytics and reports book metadata and reading activity without a clear disclosure in the package manifest. This is suspicious runtime telemetry, but the inspected code does not show credential theft or unrelated data collection.
Evidence
dist/bloomPlayer.aSwt1opT.jslocalStorage: bloom-player-read-durationlocalStorage: bloom-player-book-url
Network endpoints3
bloomlibrary.org/analytics.min.jsbloomlibrary.org/analytics.dev.min.jsbloomlibrary.org/analytics.test.min.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is a Bloom book display library, and the bundle loads analytics by default unless the URL contains `independent=false`.
- Production analytics code loads from `https://bloomlibrary.org/analytics.min.js`.
- On book open, the player tracks an event with book metadata including title, creator, publisher, book instance ID and session ID.
- The player records reading progress metrics such as pages read, audio and video duration, and reading duration.
Evidence against
- The manifest has no lifecycle scripts, and the exported module is a browser library for displaying books.
- The bidi-like characters found in the bundle are left-to-right marks in multilingual language-name data; no bidi control characters were found.
Behavioral surface
EvalFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/bloomPlayer.aSwt1opT.jsView file
27contains invisible/control Unicode U+200E (left-to-right mark)
abk ab Abkhazian аҧсуа бызшәа<U+200E> (Aṗsua byzšwa), аҧсшәа<U+200E> (Aṗsšwa)
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/bloomPlayer.aSwt1opT.jsView on unpkg · L277function(){var r=Array.prototype.slice.call(arguments);return r.unshift(a),e.push(r),e}};for(var t=0;t<e.methods.length;t++){var n=e.methods[t];e[n]=e.factory(n)}e.load=function(a,r){var l=document.createElement("script");l.type="text/javascript",l.async=!0,l.src=KS();var d=document.getElementsByTagName("script")[0];d.parentNode.insertBefore(l,d),e._loadOptions=r},e.SNIPPET_VERSION="4.1.0"}})();window.location.search.includes("independent=false")||(window.analytics.load(),window.onbeforeunload=R
Medium
Ai Review Evidence
The package is a Bloom book display library, and the bundle loads analytics by default unless the URL contains `independent=false`.
dist/bloomPlayer.aSwt1opT.jsView on unpkg · L77indow.location.search.includes("dev.bloomlibrary.org")?jo.Dev:window.location.hostname==="localhost"||window.location.search.includes("localhost")?jo.Test:jo.Prod}function KS(){switch(OS()){case jo.Prod:return"https://bloomlibrary.org/analytics.min.js";case jo.Dev:return"https://bloomlibrary.org/analytics.dev.min.js";default:return"https://bloomlibrary.org/analytics.test.min.js"}}function bi(e){const t=JSON.stringify
Findings
1 Critical1 High6 Medium4 Low
CriticalTrojan Source Unicodedist/bloomPlayer.aSwt1opT.js
HighPrevious Version Dangerous Deltalib/shared.es.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/bloomPlayer.aSwt1opT.js
MediumAi Review Evidencedist/bloomPlayer.aSwt1opT.js
MediumAi Review Evidencedist/bloomPlayer.aSwt1opT.js
MediumAi Review Evidencedist/bloomPlayer.aSwt1opT.js
MediumAi Review Evidencedist/bloomPlayer.aSwt1opT.js
LowEvaldist/bloomPlayer.aSwt1opT.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to bloom-player@2.22.0.
See all versions of bloom-player for other recorded verdicts.
- Review the evidence and your use of bloom-player@2.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.