registry / comein-player-web / 0.1.11

comein-player-web@0.1.11

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The inspected manifest has no lifecycle hooks, and the required bundle and stylesheet are consistent with a browser SDK. Its network request handles caller-supplied authentication data for configured Comein endpoints, with no concrete malicious behavior found.

Static reason

No blocking static signals were detected.

Trigger

Importing and using the SDK's authentication or player APIs.

Impact

No install-time execution, foreign control-surface mutation, or confirmed unconsented data exfiltration was found.

Mechanism

Authentication posts caller-provided user information to the configured Comein service; bundled CSS loads local font files.

AI rationale

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes bundled browser entrypoints and contains no lifecycle scripts.
The UMD entry is a browser export wrapper for the SDK.
The stylesheet only declares bundled Element UI font assets.
Authentication sends caller-supplied user information to the configured Comein API endpoint.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: server.comein.cn, testserver.comein.cn, v2.vuejs.org, www.w3.org

Oversized source lightweight scan

dist/index.esm.js7.45 MB file, sampled 256 KB

NetworkHighEntropyStringsUrlStrings

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Low

Ai Review Evidence

The UMD entry is a browser export wrapper for the SDK.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7810944 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

Lines 1-21text

1@charset "UTF-8";@font-face{font-family:element-icons;src:url(fonts/element-icons.woff) format("woff"),url(fonts/element-icons.ttf) format("truetype");font-weight:400;font-display:"auto";font-style:normal}[class*=" el-icon-"],[class^=el-icon-]{font-family:element-icons!important;speak:none;font-style:normal;font-weight:400;font-variant:normal;text-transform:none;line-height:1;vertical-align:baseline;display:inline-block;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.el-icon-ice-cream-round:before{content:"\e6a0"}.el-icon-ice-cream-square:before{content:"\e6a3"}.el-icon-l ...

Low

Ai Review Evidence

The stylesheet only declares bundled Element UI font assets.

dist/index.cssView on unpkg · L1

2.c-tooltips[data-v-5f2cb13d]{align-items:center;bottom:0;display:flex;flex-direction:row;justify-content:center;left:0;pointer-events:none;position:fixed;right:0;top:0;z-index:99999}.c-tooltips.is-player-center[data-v-5f2cb13d]{position:absolute}.c-tooltips .tooltips[data-v-5f2cb13d]{background-color:rgba(0,0,0,.72);border-radius:4px;color:#fff;line-height:20px;max-width:800px;min-width:168px;padding:16px 20px;text-align:center}.c-tooltips .tooltips .icon-player[data-v-5f2cb13d]{color:#fff;font-size:16px;line-height:20px;margin-right:8px}.c-tooltips .tooltips .tooltips-desc[data-v-5f2cb13d]{ma ...

3 /*! autoprefixer: off */-webkit-box-orient:vertical;

4 /*! autoprefixer: off */-webkit-line-clamp:2;color:#27264d;display:-webkit-box;font-size:14px;font-weight:500;line-height:20px;overflow:hidden;text-align:justify;text-overflow:ellipsis}.c-player.is-playback .ctrl-bottom[data-v-d188f262]{animation:hide 1.5s 1;animation-fill-mode:forwards;opacity:0;user-select:none}.c-player.is-enter .ctrl-bottom[data-v-d188f262]{animation:none;opacity:1}.c-player.is-screen .ctrl-bottom .icon-player[data-v-d188f262]{font-size:20px;height:20px;width:20px}.c-player__trailer[data-v-33c64b1c]{height:100%;left:0;position:absolute;top:0;width:100%;z-index:99}.c-play ...

package.jsonView file

2"name": "comein-player-web", "version": "0.1.11", "description": "Customer-facing Web SDK built on top of the Comein player SDK.", "type": "module", "main": "./dist/index.umd.js", "module": "./dist/index.esm.js",

Low

Suspicious Lifecycle Evidence

The manifest exposes bundled browser entrypoints and contains no lifecycle scripts.

package.jsonView on unpkg · L2

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Low

Ai Review Evidence

The UMD entry is a browser export wrapper for the SDK.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.js

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.umd.js

LowAi Review Evidencedist/index.css

Affected versions and remediation

This report applies to comein-player-web@0.1.11.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 13:52:16.756Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.