registry / comein-player-web / 0.1.3

comein-player-web@0.1.3

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a browser player SDK with user-invoked authentication and local session storage, not an install-time or covert execution chain. The high-risk bundle and CSS findings are explained by bundled UI dependencies and styling.

Static reason

No blocking static signals were detected.

Trigger

Calling createWebPlayer with userInfo.

Impact

No malicious impact was confirmed.

Mechanism

User-invoked browser authentication and player setup.

AI rationale

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The runtime posts caller-supplied userInfo to Comein authentication endpoints and stores the returned session in browser storage.
The flagged UMD file is a bundled browser artifact containing vendored Vue code.
The flagged CSS file contains player layout styling.

Evidence against

package.json has no install or lifecycle scripts.
Network calls are made only when the caller invokes authentication.
No filesystem harvesting, shell execution, remote code loading, or install-time persistence was found.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: github.com, server.comein.cn, testserver.comein.cn, v2.vuejs.org, vuejs.org, www.w3.org

Oversized source lightweight scan

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7771127 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

183const AUTH_ENDPOINTS = { channelLogin: 'json_user_webchannellogin', }; const DEFAULT_UC = DEFAULT_BRIDGE.uc; const FORMAL_BASE_URL = 'https://server.comein.cn/comein'; const TEST_BASE_URL = 'https://testserver.comein.cn/comein';

Low

Ai Review Evidence

The runtime posts caller-supplied userInfo to Comein authentication endpoints and stores the returned session in browser storage.

dist/index.esm.jsView on unpkg · L183

262const request = dependencies.request || (requestConfig => defaultRequest(requestConfig, options)); const result = await request({ endpoint: AUTH_ENDPOINTS.channelLogin, body: { uc: DEFAULT_UC, userinfo: encodedUserInfo }, headers: {}, });

Low

Ai Review Evidence

The runtime posts caller-supplied userInfo to Comein authentication endpoints and stores the returned session in browser storage.

dist/index.esm.jsView on unpkg · L262

160const browserStorage = getBrowserStorage(storage); try { if (browserStorage.localStorage) { browserStorage.localStorage.setItem(USER_SAVE_KEY, '1'); browserStorage.localStorage.setItem(USER_INFO_KEY, encode$2(JSON.stringify(userInfo))); }

Low

Ai Review Evidence

The runtime posts caller-supplied userInfo to Comein authentication endpoints and stores the returned session in browser storage.

dist/index.esm.jsView on unpkg · L160

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7771127 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencedist/index.esm.js

Affected versions and remediation

This report applies to comein-player-web@0.1.3.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-10 03:37:50.835Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.