clintplay-sdk@0.9.0

Clintplay - Session replay, error tracking, and automatic Playwright test generation

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source inspection supports ordinary browser analytics behavior: the package masks inputs by default, sanitizes recorded network events, and sends event batches to its configured analytics endpoint. The scanner’s account-hijack finding is not supported by inspected source, so the package is clean.

Static reason

No blocking static signals were detected.

Trigger

The consumer imports and starts the SDK in a browser.

Impact

Events are reported for analytics; inspected code does not establish account takeover or credential theft.

Mechanism

It records browser events and posts event batches to the configured API endpoint.

AI rationale

Evidence

dist/index.js

Network endpoints1

api.clintplay.example/v1

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json identifies a browser session-replay and error-tracking SDK with dist/index.js as its CommonJS entrypoint.
dist/index.js enables input masking by default and starts network recording through a sanitizer.
The bundle sends collected events to the configured API endpoint using a POST request.
The inspected bundle contains no account-setting mutation or authenticated-session reuse supporting the flagged account-hijack finding.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 265 KB of source, external domains: api.clintplay.example, evilmartians.com, www.w3ctech.com

Source & flagged code

6 flagged

dist/index.jsView file

1'use strict';Object.defineProperty(exports,'__esModule',{value:true});var rrweb=require('rrweb');var ee={apiUrl:"https://api.clintplay.example/v1",maskAllInputs:true,recordNetwork:... L2: `)),r.length;e+=m;let E=g.replace(/\$/g,"$$$$"),y=p.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),v=new RegExp(`url\$\\s*(?:"${y}"|'${y}'|${y})\\s*\$`);d=d.replace(v,`url("${E}")`),o=tru...

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.jsView on unpkg · L1

1maskAllInputs:true,recordNetwork:true,recordConsole:true,trackPerformance:true,trackRageClicks:true,trackNavigation:true,compressEvents:true,persistence:"localStorage",flushIntervalMs:15e3,f

Low

Ai Review Evidence

dist/index.js enables input masking by default and starts network recording through a sanitizer.

dist/index.jsView on unpkg · L1

3recordNetwork&&($=new x(e.id,s=>{let i=J.sanitizeNetworkEvent(s.data);f({...s,data:i});},c.apiUrl,c.networkIgnoreUrls),$.start()),c.recordConsole&&(z=new A(e.id,f),z.start()),c.trackPerforma

Low

Ai Review Evidence

dist/index.js enables input masking by default and starts network recording through a sanitizer.

dist/index.jsView on unpkg · L3

3sessionId:this.config.sessionId,...this.config.anonId?{anonId:this.config.anonId}:{},...this.config.sdkVersion?{sdkVersion:this.config.sdkVersion}:{},events:e,sentAt:Date.now()},n=JSON.strin

Low

Ai Review Evidence

The bundle sends collected events to the configured API endpoint using a POST request.

dist/index.jsView on unpkg · L3

dist/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.js#virtual:normalized:round1View on unpkg

package.jsonView file

2"name": "clintplay-sdk", "version": "0.9.0", "description": "Clintplay - Session replay, error tracking, and automatic Playwright test generation", "main": "./dist/index.js

Low

Ai Review Evidence

package.json identifies a browser session-replay and error-tracking SDK with dist/index.js as its CommonJS entrypoint.

package.jsonView on unpkg · L2

Source & flagged code

6 flagged · loading source

dist/index.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.jsView on unpkg · L1

1maskAllInputs:true,recordNetwork:true,recordConsole:true,trackPerformance:true,trackRageClicks:true,trackNavigation:true,compressEvents:true,persistence:"localStorage",flushIntervalMs:15e3,f

Low

Ai Review Evidence

dist/index.js enables input masking by default and starts network recording through a sanitizer.

dist/index.jsView on unpkg · L1

3recordNetwork&&($=new x(e.id,s=>{let i=J.sanitizeNetworkEvent(s.data);f({...s,data:i});},c.apiUrl,c.networkIgnoreUrls),$.start()),c.recordConsole&&(z=new A(e.id,f),z.start()),c.trackPerforma

Low

Ai Review Evidence

dist/index.js enables input masking by default and starts network recording through a sanitizer.

Findings

2 High2 Medium8 Low

HighBrowser Session Account Hijackdist/index.js

HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to clintplay-sdk@0.9.0.

See all versions of clintplay-sdk for other recorded verdicts.

Review the evidence and your use of clintplay-sdk@0.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 03:23:46.591Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.