comein-player-web@0.1.8
Customer-facing Web SDK built on top of the Comein player SDK.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install-time behavior, but its runtime logger explicitly places authentication tokens in telemetry data. That is a real unresolved credential-handling risk, though the inspected source does not establish malicious intent.
Static reason
No blocking static signals were detected.
Trigger
An application imports the SDK and creates a web player with user information.
Impact
A user token and browser metadata may be sent to the package's logging infrastructure, creating a credential-exposure risk if that telemetry path is not trusted.
Mechanism
Authenticated player telemetry and service requests.
AI rationale
The package has no install-time behavior, but its runtime logger explicitly places authentication tokens in telemetry data. That is a real unresolved credential-handling risk, though the inspected source does not establish malicious intent.
Evidence
dist/index.umd.js
Network endpoints3
server.comein.cn/comeintestserver.comein.cn/comeincn-hangzhou.log.aliyuncs.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The browser logger includes the supplied user token or web token in its default telemetry payload along with identifying and browser data.
- Importing the package selects a browser bundle as its main and module entry point.
Evidence against
- The manifest has no install or lifecycle scripts.
- The inspected behavior is a customer-facing web player, storage, authentication, and telemetry code; no Node command execution or project-file mutation was found.
- The stylesheet is ordinary UI and font styling.
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
4 flagged · loading sourcedist/index.umd.jsView file
1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
L2: /*!
...
L5: * Released under the MIT License.
L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){...
L7: /*!
...
L51: */
L52: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25...
L53: /*!
...
L57: */
L58: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.umd.jsView on unpkg · L152t.createDefaultData=function(){var e,t=this.getUserInfo(),i=this.getExtra()||{};return{id:generateGUID(),loggerId:this.loggerId,uid:(null==t?void 0:t.uid)||"",token:(null==t?void 0:t.token)||(null==t?void 0:t.webtoken)||"",timestamp:Date.now(),userAgent:navigator.userAgent,roadshowId:this.roadshowId,extra:_extends({locale:null===(e=this.i18n)||void 0===e?void 0:e.locale,language:navigator.language
Medium
Ai Review Evidence
The browser logger includes the supplied user token or web token in its default telemetry payload along with identifying and browser data.
dist/index.umd.jsView on unpkg · L52Findings
2 High5 Medium3 Low
HighBrowser Session Account Hijackdist/index.umd.js
HighSemantic Analysis Limiteddist/index.css
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.esm.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.umd.js
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to comein-player-web@0.1.8.
See all versions of comein-player-web for other recorded verdicts.
- Review the evidence and your use of comein-player-web@0.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.