registry / comein-player-web / 0.1.4

comein-player-web@0.1.4

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is a browser player SDK with no install hooks. Its network and storage behavior is directly tied to caller-invoked authentication, and no concrete malicious behavior was found.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls createWebPlayer with user information.

Impact

The configured service receives authentication input; session data is retained in browser storage for the player.

Mechanism

Posts authentication data to the configured Comein service and stores the resulting browser session.

AI rationale

The package is a browser player SDK with no install hooks. Its network and storage behavior is directly tied to caller-invoked authentication, and no concrete malicious behavior was found.

Evidence

localStorage

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The browser bundle stores supplied or authenticated user session data in local storage and sends authentication requests to Comein endpoints.
The package ships a large bundled web player, which increases review surface.

Evidence against

package.json has no lifecycle scripts and exposes browser bundle entry points only.
Authentication occurs only through createWebPlayer/authenticate with caller-provided user information; no install-time execution is present.
The flagged CSS is presentation styling, not executable logic.
No source evidence of shell execution, filesystem access, secret harvesting, covert exfiltration, persistence, or account-setting mutation was found.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: github.com, server.comein.cn, testserver.comein.cn, v2.vuejs.org, vuejs.org, www.w3.org

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1const USER_SAVE_KEY="usersave",USER_INFO_KEY="userinfo";function getBrowserStorage(e){return e&&(e.localStorage||e.sessionStorage)?e:"undefined"==typeof globalThis?{}:{localStorage:globalThis.localStorage,sessionStorage:globalThis.sessionStorage}}

Low

Ai Review Evidence

The browser bundle stores supplied or authenticated user session data in local storage and sends authentication requests to Comein endpoints.

dist/index.umd.jsView on unpkg · L1

1const AUTH_ENDPOINTS={channelLogin:"json_user_webchannellogin"},FORMAL_BASE_URL="https://server.comein.cn/comein",TEST_BASE_URL="https://testserver.comein.cn/comein";

Low

Ai Review Evidence

The browser bundle stores supplied or authenticated user session data in local storage and sends authentication requests to Comein endpoints.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7775185 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

package.jsonView file

6"main": "./dist/index.umd.js", "module": "./dist/index.esm.js", "types": "./dist/index.d.ts", "exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.esm.js", "default": "./dist/index.umd.js" }, "./dist/index.css": "./dist/index.css" },

Low

Ai Review Evidence

The package ships a large bundled web player, which increases review surface.

package.jsonView on unpkg · L6

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Low

Ai Review Evidence

The browser bundle stores supplied or authenticated user session data in local storage and sends authentication requests to Comein endpoints.

dist/index.umd.jsView on unpkg · L1

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowAi Review Evidencedist/index.umd.js

LowAi Review Evidencepackage.json

Affected versions and remediation

This report applies to comein-player-web@0.1.4.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 06:43:30.179Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.