registry / comein-player-web / 0.1.15
comein-player-web@0.1.15
Customer-facing Web SDK built on top of the Comein player SDK.
AI Security Review
scanned 27d ago · by lpm-firewall-aiStatic review shows a player SDK with no lifecycle scripts and an explicit opt-out for the bundled Aliplayer debugger check. Cookie helpers and iframe messaging stay inside ordinary player behavior, with no exfiltration or install-time control-surface write.
Static reason
No blocking static signals were detected.
Trigger
No install hook or automatic malicious trigger is present. Anti-debug code runs only as part of constructing the video player.
Impact
Installing or importing the package does not harvest credentials, mutate agent config, or fetch a remote payload.
Mechanism
package.json has no scripts. Player initialization sets a known Aliplayer flag that cancels the debugger check. Styles reference only local font files.
AI rationale
Static review shows a player SDK with no lifecycle scripts and an explicit opt-out for the bundled Aliplayer debugger check. Cookie helpers and iframe messaging stay inside ordinary player behavior, with no exfiltration or install-time control-surface write.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json 0.1.15 is a browser player SDK whose entrypoints are dist bundles and types, with no lifecycle scripts, bin, or dependencies.
- The player sets Aliplayer __unable2Anti9Debugger13Key to error and logs that the player debugger is cancelled outside a production third-party build.
- dist/index.css only loads the local element-icons font files packaged beside the stylesheet.
Evidence against
- The bundled Aliplayer code includes a control-flow-flattened eval of the constant string debugger and blanks console methods when its devtools check runs; that path is player runtime behavior with an SDK opt-out, not an install hook or remote payload.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcedist/index.umd.jsView file
1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
L2: /*!
...
L5: * Released under the MIT License.
L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){...
L7: /*!
...
L51: */
L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25...
L53: /*!
...
L57: */
L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.umd.jsView on unpkg · L179取消player debugger"),h.__unable2Anti9Debugger13Key="error"),this.video=new h(c,e=>{this.video=e}),this.onEvent()},onEvent(){this.video.on("ready",this.onReady),this.video.on("canplay",this.onCanpla
Low
Ai Review Evidence
The player sets Aliplayer __unable2Anti9Debugger13Key to error and logs that the player debugger is cancelled outside a production third-party build.
dist/index.umd.jsView on unpkg · L79Findings
2 High4 Medium6 Low
HighBrowser Session Account Hijackdist/index.umd.js
HighSemantic Analysis Limiteddist/index.css
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.esm.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.umd.js
LowAi Review Evidencedist/index.css
Affected versions and remediation
This report applies to comein-player-web@0.1.15.
See all versions of comein-player-web for other recorded verdicts.
- Review the evidence and your use of comein-player-web@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.