registry / comein-player-web / 0.1.10

comein-player-web@0.1.10

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Inspected entrypoints and authentication behavior are consistent with the package's browser player functionality. Dynamic execution and telemetry did not establish a concrete malicious chain.

Static reason

No blocking static signals were detected.

Trigger

The caller invokes createWebPlayer with player options and user information; installation has no lifecycle hook.

Impact

No malicious installation, credential harvesting, destructive filesystem changes, or agent control-surface mutation was established.

Mechanism

The SDK authenticates caller-provided information, creates player controls, and uses browser storage and package-aligned services.

AI rationale

Inspected entrypoints and authentication behavior are consistent with the package's browser player functionality. Dynamic execution and telemetry did not establish a concrete malicious chain.

Network endpoints3

server.comein.cn/comeintestserver.comein.cn/comeincn-hangzhou.log.aliyuncs.com

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes browser SDK bundles and contains no lifecycle scripts or runtime dependencies.
Player creation explicitly authenticates information supplied by the caller.
Both bundles use caller-supplied user information for authentication and browser session storage.
The stylesheet loads local icon fonts and contains no HTTP references.
Bundled telemetry uses a fixed Comein logging project.

Evidence against

The bundle contains obfuscated developer-tools detection and dynamic execution, but inspection linked these to player debugging protection and media processing rather than an attack.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: server.comein.cn, testserver.comein.cn, v2.vuejs.org, www.w3.org

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1async function createWebPlayer(e,t={},i={}){assertContainer(e),normalizeOptions(t);const n=await(i.authenticate||authenticate)(t,i),r={...t};n&&(r.userInfo=n);const o=normalizeOptions(r),s=create

Low

Ai Review Evidence

Player creation explicitly authenticates information supplied by the caller.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7809058 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

1@font-face{font-family:element-icons;src:url(fonts/element-icons.woff) format("woff"),url(fonts/element-icons.ttf) format("truetype");font-weight:400;font-display:"

Low

Ai Review Evidence

The stylesheet loads local icon fonts and contains no HTTP references.

dist/index.cssView on unpkg · L1

package.jsonView file

5"type": "module", "main": "./dist/index.umd.js", "module": "./dist/index.esm.js", "types": "./dist/index.d.ts", "exports": { ".": { "types": "./dist/i

Low

Suspicious Lifecycle Evidence

package.json exposes browser SDK bundles and contains no lifecycle scripts or runtime dependencies.

package.jsonView on unpkg · L5

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1async function createWebPlayer(e,t={},i={}){assertContainer(e),normalizeOptions(t);const n=await(i.authenticate||authenticate)(t,i),r={...t};n&&(r.userInfo=n);const o=normalizeOptions(r),s=create

Low

Ai Review Evidence

Player creation explicitly authenticates information supplied by the caller.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.js

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.umd.js

LowAi Review Evidencedist/index.css

Affected versions and remediation

This report applies to comein-player-web@0.1.10.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 10:48:23.786Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.