registry / comein-player-web / 0.1.1

comein-player-web@0.1.1

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No concrete malware or install-hook abuse was found, but the large minified browser artifacts and unresolved runtime data flow prevent a clean verdict. The network behavior appears package-aligned but warrants a warning.

Static reason

No blocking static signals were detected.

Trigger

A web application imports the package and calls createWebPlayer with user information.

Impact

Caller-provided session or user data may be sent to the configured Comein services; no unconsented install-time attack was confirmed.

Mechanism

Browser fetch requests and real-time player networking

AI rationale

Evidence

dist/index.umd.js

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The package exposes multi-megabyte minified browser bundles, so complete behavioral assessment is not possible from the distributed artifacts.
The browser bundle defines Comein service endpoints and a default request function using fetch.
The manifest exposes the bundled UMD entry point.
The CSS includes an embedded font data URI, adding a large opaque asset to the reviewed distribution.

Evidence against

package.json has no lifecycle scripts, dependencies, or executable bin entry.
The TypeScript declarations describe an explicit createWebPlayer API with caller-supplied user information.
No install-time filesystem mutation, shell execution, or foreign endpoint was confirmed.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: github.com, server.comein.cn, testserver.comein.cn, v2.vuejs.org, vuejs.org, www.w3.org

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

78/*! comein-player-web@0.1.1-14 */

Medium

Ai Review Evidence

The package exposes multi-megabyte minified browser bundles, so complete behavioral assessment is not possible from the distributed artifacts.

dist/index.umd.jsView on unpkg · L78

1FORMAL_BASE_URL="https://server.comein.cn/comein",TEST_BASE_URL="https://testserver.comein.cn/comein"

Medium

Ai Review Evidence

The browser bundle defines Comein service endpoints and a default request function using fetch.

dist/index.umd.jsView on unpkg · L1

1async function defaultRequest({endpoint:e,body:t,headers:i},n){if("function"!=typeof fetch)

Medium

Ai Review Evidence

The browser bundle defines Comein service endpoints and a default request function using fetch.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7770952 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

78/*! comein-player-web@0.1.1-14 */

Medium

Ai Review Evidence

The package exposes multi-megabyte minified browser bundles, so complete behavioral assessment is not possible from the distributed artifacts.

dist/index.umd.jsView on unpkg · L78

1FORMAL_BASE_URL="https://server.comein.cn/comein",TEST_BASE_URL="https://testserver.comein.cn/comein"

Findings

2 High7 Medium3 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.umd.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to comein-player-web@0.1.1.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-10 02:21:51.647Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.