comein-player-web@0.1.6: Suspicious npm security report (Warn)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No concrete malicious behavior was established, but incomplete static coverage of the large bundled browser runtime prevents a grounded clean verdict. The observed network and storage behavior is authentication-related and package-aligned.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls the SDK authentication or player-creation flow with user information.

Impact

An authenticated SDK session may be created in the hosting browser; the incomplete analysis coverage leaves residual uncertainty about the large bundled runtime.

Mechanism

Remote SDK authentication followed by browser session storage.

AI rationale

No concrete malicious behavior was established, but incomplete static coverage of the large bundled browser runtime prevents a grounded clean verdict. The observed network and storage behavior is authentication-related and package-aligned.

Evidence

dist/index.umd.jslocalStoragesessionStorage

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Suspicious at 70.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The main browser bundle authenticates supplied user information against Comein endpoints and stores returned session information in browser storage.
The published runtime artifacts are heavily bundled and scanner coverage was incomplete, so the full browser behavior cannot be conclusively cleared by static review.

Evidence against

package.json has no install or lifecycle scripts and exports only files under dist.
The inspected authentication path uses fetch for the SDK login flow; no package-install execution, child-process use, or filesystem access was found.
The CSS artifact is a stylesheet containing font and UI rules, not executable code.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: github.com, server.comein.cn, testserver.comein.cn, v2.vuejs.org, vuejs.org, www.w3.org

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1const USER_SAVE_KEY="usersave",USER_INFO_KEY="userinfo";function getBrowserStorage(e){return e&&(e.localStorage||e.sessionStorage)?e:"undefined"==typeof globalThis?{}:{localStorage:globalThis.localStorage,sessionStorage:globalThis.sessionStorage}}

Medium

Ai Review Evidence

The main browser bundle authenticates supplied user information against Comein endpoints and stores returned session information in browser storage.

dist/index.umd.jsView on unpkg · L1

1const AUTH_ENDPOINTS={channelLogin:"json_user_webchannellogin"},FORMAL_BASE_URL="https://server.comein.cn/comein",TEST_BASE_URL="https://testserver.comein.cn/comein";

Medium

Ai Review Evidence

The main browser bundle authenticates supplied user information against Comein endpoints and stores returned session information in browser storage.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 7775990 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

package.jsonView file

6"main": "./dist/index.umd.js", "module": "./dist/index.esm.js", "types": "./dist/index.d.ts", "exports": {

Medium

Ai Review Evidence

The published runtime artifacts are heavily bundled and scanner coverage was incomplete, so the full browser behavior cannot be conclusively cleared by static review.

package.jsonView on unpkg · L6

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /*! ... L51: */ L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L53: /*! ... L57: */ L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1const USER_SAVE_KEY="usersave",USER_INFO_KEY="userinfo";function getBrowserStorage(e){return e&&(e.localStorage||e.sessionStorage)?e:"undefined"==typeof globalThis?{}:{localStorage:globalThis.localStorage,sessionStorage:globalThis.sessionStorage}}

Medium

Ai Review Evidence

The main browser bundle authenticates supplied user information against Comein endpoints and stores returned session information in browser storage.

dist/index.umd.jsView on unpkg · L1

Findings

2 High7 Medium3 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.umd.js

MediumAi Review Evidencepackage.json

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code