registry / comein-player-web / 0.1.17

comein-player-web@0.1.17

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Active obfuscated evaluation and anti-analysis behavior create a real unresolved runtime risk. No concrete malicious payload or install-time attack was verified.

Static reason

No blocking static signals were detected.

Trigger

Importing and initializing the web player reaches the obfuscated player flow.

Impact

The evaluated code cannot be safely assessed from the inspected opaque bundle, leaving runtime behavior unresolved.

Mechanism

The flow calls an obfuscated evaluator and loads developer-tools detection code.

AI rationale

Active obfuscated evaluation and anti-analysis behavior create a real unresolved runtime risk. No concrete malicious payload or install-time attack was verified.

Evidence

dist/index.umd.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The package entrypoint is the bundled UMD file.
The UMD bundle contains heavily obfuscated control flow that evaluates a constructed string.
An obfuscated player path invokes that evaluator and loads a developer-tools detector.

Evidence against

No install lifecycle hook is declared in the manifest.
The inspected evidence does not show credential collection, data export, or destructive file actions.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: server.comein.cn, testserver.comein.cn, v2.vuejs.org, www.w3.org

Oversized source lightweight scan

dist/index.esm.js7.45 MB file, sampled 256 KB

Network

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

77gas4s8(){for(var NEXTBB24=3;void 0!==NEXTBB24;){var $jsskein_indexLevel106_0=1&NEXTBB24,$jsskein_indexLevel106_1_Base=NEXTBB24>>1,$jsskein_indexLevel106_1=1&$jsskein_indexLevel106_1_Base;switch($jsskein_indexLevel106_0){case 0:switch($jsskein_indexLevel106_1){case 0:eval(fs56j57),NEXTBB24=1;continue;case 1:NEXTBB24=void 0;continue}continue;case 1:s

Medium

Ai Review Evidence

The UMD bundle contains heavily obfuscated control flow that evaluates a constructed string.

dist/index.umd.jsView on unpkg · L77

77ase;switch($jsskein_indexLevel107_0){case 0:switch($jsskein_indexLevel107_1){case 0:kl5f8(),player[$jsskein_array_104[23]](),gas4s8(),NEXTBB34=6;continue;case 1:$jsskein_simplify_tmp31=Aliplayer[$jsskein_decrypt_variable62_ret],$jsskein_simplify_tmp31=$jsskein_array_103[11]===$jsskein_simplify_tmp31,NEXTBB34=$jsskein_simplify_tmp31?13:0;continue;ca

Medium

Ai Review Evidence

An obfuscated player path invokes that evaluator and loads a developer-tools detector.

dist/index.umd.jsView on unpkg · L77

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7811604 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

package.jsonView file

2"name": "comein-player-web", "version": "0.1.17", "description": "Customer-facing Web SDK built on top of the Comein player SDK.", "type": "module", "main": "./dist/index.umd.js", "module": "./dist/index.esm.js", "types": "./dist/index.d.ts",

Medium

Ai Review Evidence

The package entrypoint is the bundled UMD file.

package.jsonView on unpkg · L2

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Medium

Ai Review Evidence

The UMD bundle contains heavily obfuscated control flow that evaluates a constructed string.

dist/index.umd.jsView on unpkg · L77

Findings

2 High7 Medium3 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/index.umd.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to comein-player-web@0.1.17.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 02:30:37.164Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.