registry / comein-player-web / 0.1.13

comein-player-web@0.1.13

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Static inspection found no lifecycle scripts or concrete malicious behavior. Network-capable player behavior is consistent with the SDK purpose and is activated by consumer use.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls the exported player creation function.

Impact

No confirmed malicious impact was established.

Mechanism

The bundle initializes a player and uses its configured authentication flow; no install-time execution, filesystem access, or package-specific secret exfiltration was found.

AI rationale

Static inspection found no lifecycle scripts or concrete malicious behavior. Network-capable player behavior is consistent with the SDK purpose and is activated by consumer use.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Package metadata exposes browser bundle entrypoints and contains no lifecycle hooks.
The UMD entrypoint creates a player only when its exported creation function is called with caller options.
The stylesheet references packaged font assets.
Authentication has package-aligned Comein service defaults.

Evidence against

A bundled player dependency contains eval-based runtime code, but inspection found no package-specific harmful activation or exfiltration path.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: server.comein.cn, testserver.comein.cn, v2.vuejs.org, www.w3.org

Oversized source lightweight scan

dist/index.esm.js7.45 MB file, sampled 256 KB

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1n getInternalPlayer(this).raiseStatus}}async function createWebPlayer(e,t={},i={}){assertContainer(e),normalizeOptions(t);const n=await(i.authenticate||authenticate)(t,i),r={...t};n&&(r.userInfo=n);const o=normalizeOptions(r),s=createInteractiveLayout(e,o.loca

Low

Ai Review Evidence

The UMD entrypoint creates a player only when its exported creation function is called with caller options.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7811365 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

1@charset "UTF-8";@font-face{font-family:element-icons;src:url(fonts/element-icons.woff) format("woff"),url(fonts/element-icons.ttf) format("truetype");font-weight:400;font-display:

Low

Ai Review Evidence

The stylesheet references packaged font assets.

dist/index.cssView on unpkg · L1

package.jsonView file

1{ "name": "comein-player-web", "version": "0.1.13", "description": "Customer-facing Web SDK built on top of the Comein player SDK.", "type": "module", "main": "./dist/index.umd.js", "module": "./dist/index.esm.js", "types": "./dist/index.d.ts", "export

Low

Suspicious Lifecycle Evidence

Package metadata exposes browser bundle entrypoints and contains no lifecycle hooks.

package.jsonView on unpkg · L1

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Low

Ai Review Evidence

The UMD entrypoint creates a player only when its exported creation function is called with caller options.

dist/index.umd.jsView on unpkg · L1

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.umd.js

LowAi Review Evidencedist/index.css

Affected versions and remediation

This report applies to comein-player-web@0.1.13.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 06:46:12.304Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.