registry / comein-player-web / 0.1.22

comein-player-web@0.1.22

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Inspected source supports a browser player SDK without automatic installation hooks or a concrete malicious chain. Bundled code-generation primitives and authentication handling did not establish an active attack.

Static reason

No blocking static signals were detected.

Trigger

The caller invokes createWebPlayer with a container and user information.

Impact

Expected player and session behavior; no confirmed credential harvesting, malicious filesystem mutation, or remote payload execution was established.

Mechanism

The SDK authenticates caller-supplied data and initializes bundled player components; configurable authentication uses data supplied for that request.

AI rationale

Network endpoints3

server.comein.cn/comeintestserver.comein.cn/comeinwss://im.comein.cn:7443/ws/

Decision evidence

public snapshot

AI called this Clean at 85.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines browser SDK entrypoints and contains no lifecycle scripts or runtime self-dependency.
dist/index.umd.js activates authentication and player setup through createWebPlayer with caller options.
dist/index.css provides styles scoped to the SDK layout.
Authentication reads user information explicitly supplied by the caller and sends it to the channel login endpoint; existing token objects bypass login requests.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: server.comein.cn, testserver.comein.cn, v2.vuejs.org, www.w3.org

Oversized source lightweight scan

dist/index.esm.js7.45 MB file, sampled 256 KB

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1async function createWebPlayer(e,t={},i={}){assertContainer(e),normalizeOptions(t);const n=await(i.authenticate||authenticate)(t,i),r={...t};n&&(r.userInfo=n);

Low

Ai Review Evidence

dist/index.umd.js activates authentication and player setup through createWebPlayer with caller options.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7811414 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

1.comein-web-sdk-layout [class*=" el-icon-"],.comein-web-sdk-layout [class^=el-icon-]{font-family:element-icons!important;

Low

Ai Review Evidence

dist/index.css provides styles scoped to the SDK layout.

dist/index.cssView on unpkg · L1

package.jsonView file

6"main": "./dist/index.umd.js", "module": "./dist/index.esm.js", "types": "./dist/index.d.ts",

Low

Suspicious Lifecycle Evidence

package.json defines browser SDK entrypoints and contains no lifecycle scripts or runtime self-dependency.

package.jsonView on unpkg · L6

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1async function createWebPlayer(e,t={},i={}){assertContainer(e),normalizeOptions(t);const n=await(i.authenticate||authenticate)(t,i),r={...t};n&&(r.userInfo=n);

Low

Ai Review Evidence

dist/index.umd.js activates authentication and player setup through createWebPlayer with caller options.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.js

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.umd.js

LowAi Review Evidencedist/index.css

Affected versions and remediation

This report applies to comein-player-web@0.1.22.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.22 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 03:57:14.658Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.