registry / Data exfiltration / comein-player-web / 0.1.5

comein-player-web@0.1.5

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not proven malicious, but it contains broad browser telemetry that can include tokens and full HTTP contents in an opaque, minified distribution. This warrants a warning until the logging activation and data-handling boundaries are independently verified.

Static reason

No blocking static signals were detected.

Trigger

Importing and initializing the web SDK and its logging features in a browser.

Impact

Authentication tokens and application request or response content may be included in telemetry if logging is enabled.

Mechanism

Browser telemetry collection and remote SDK requests.

AI rationale

Evidence

dist/index.umd.jslocalStorage

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser logger builds telemetry containing a user ID, token or web token, timestamp, and user agent.
The logger records XHR request headers, request data, responses, and response headers before sending telemetry.
The bundle contacts Comein production or test endpoints for authenticated SDK functions.
The distribution is a very large minified bundle; its CSS is also a single-line bundled asset, limiting straightforward source attribution.

Evidence against

package.json contains no preinstall, install, postinstall, or other lifecycle script.
The manifest exports browser bundles and declares the package as a customer-facing web SDK.
No Node child-process, filesystem, or install-time execution was identified in the inspected entry bundle.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

52return{id:generateGUID(),loggerId:this.loggerId,uid:(null==t?void 0:t.uid)||"",token:(null==t?void 0:t.token)||(null==t?void 0:t.webtoken)||"",timestamp:Date.now(),userAgent:navigator.userAgent,roadshowId:this.roadshowId

Medium

Ai Review Evidence

The browser logger builds telemetry containing a user ID, token or web token, timestamp, and user agent.

dist/index.umd.jsView on unpkg · L52

52this._sendInternal(LoggerStore.XHR,{api:i,url:n,method:r,headers:o,data:a,params:l,response:u,responseHeaders:d,status:h,error:f,extra:g},t)

Medium

Ai Review Evidence

The logger records XHR request headers, request data, responses, and response headers before sending telemetry.

dist/index.umd.jsView on unpkg · L52

1const AUTH_ENDPOINTS={channelLogin:"json_user_webchannellogin"},FORMAL_BASE_URL="https://server.comein.cn/comein",TEST_BASE_URL="https://testserver.comein.cn/comein";

Medium

Ai Review Evidence

The bundle contacts Comein production or test endpoints for authenticated SDK functions.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7775582 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Medium

Ai Review Evidence

The browser logger builds telemetry containing a user ID, token or web token, timestamp, and user agent.

dist/index.umd.jsView on unpkg · L52

Findings

2 High7 Medium3 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.umd.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to comein-player-web@0.1.5.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.1.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 09:27:13.255Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.