comein-player-web
Customer-facing Web SDK built on top of the Comein player SDK.
This report shows the evidence for comein-player-web@0.1.0. 1 of 24 known versions is blocked or flagged. The newest version, 0.2.3, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe UMD entrypoint is intentionally obfuscated and dynamically evaluates generated code. This is concrete opaque runtime execution in the package's normal import path.
Static reason
One or more suspicious static signals were detected.
Trigger
Import or load the package's default UMD entrypoint in a browser application.
Impact
The bundle can execute arbitrary browser-side code outside the readable SDK implementation.
Mechanism
Obfuscated string construction followed by eval.
Attack narrative
The manifest directs default consumers to dist/index.umd.js. That bundle includes opaque, generated-looking control flow that evaluates a computed value with eval. Because the evaluated source is hidden behind the obfuscation and is not represented by the readable ESM implementation, importing the normal entrypoint creates an unreviewable arbitrary-code execution path.
AI rationale
The UMD entrypoint is intentionally obfuscated and dynamically evaluates generated code. This is concrete opaque runtime execution in the package's normal import path.
Evidence
package.jsondist/index.umd.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default package entrypoint is the UMD bundle.
- The UMD bundle contains deliberately obfuscated control flow that dynamically evaluates a constructed string.
Evidence against
- The manifest has no install or lifecycle scripts.
- The visible ESM authentication code uses named Comein service endpoints, but it does not explain the opaque UMD evaluator.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
dist/index.esm.js7.33 MB file, sampled 256 KB
NetworkHighEntropyStrings
Source & flagged code
5 flagged · loading sourcedist/index.umd.jsView file
1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
L2: /*!
...
L5: * Released under the MIT License.
L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){...
L7: /*!
...
L51: */
L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25...
L53: /*!
...
L57: */
L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.umd.jsView on unpkg · L177case 0:eval(fs56j57),NEXTBB24=1;continue;case 1:NEXTBB24=void 0;continue
High
Ai Review Evidence
The UMD bundle contains deliberately obfuscated control flow that dynamically evaluates a constructed string.
dist/index.umd.jsView on unpkg · L77dist/index.esm.jsView file
Findings
4 High4 Medium3 Low
HighBrowser Session Account Hijackdist/index.umd.js
HighSemantic Analysis Limiteddist/index.css
HighAi Review Evidencepackage.json
HighAi Review Evidencedist/index.umd.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.esm.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to comein-player-web@0.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing comein-player-web@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.