registry / comein-player-web / 0.2.0
comein-player-web@0.2.0
Customer-facing Web SDK built on top of the Comein player SDK.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe flagged session and network behavior is consistent with the Comein SDK: authentication and STS requests use Comein endpoints, while telemetry sending is gated to Comein-owned page hosts. The inspected CSS is presentation-only, and no concrete attack behavior was established.
Static reason
No blocking static signals were detected.
Trigger
Telemetry sending requires a Comein-owned page hostname, a configured tracker, and available STS credentials.
Impact
No unrelated credential recipient or account-setting mutation was established from the inspected source.
Mechanism
The bundle adds the current Comein user identifier and token to tracker data; inspected authentication requests target Comein services.
AI rationale
The flagged session and network behavior is consistent with the Comein SDK: authentication and STS requests use Comein endpoints, while telemetry sending is gated to Comein-owned page hosts. The inspected CSS is presentation-only, and no concrete attack behavior was established.
Evidence
package.jsondist/index.umd.jsdist/index.css
Network endpoints4
server.comein.cn/comeintestserver.comein.cn/comeinserver.comein.cn/comein/json_sts_get-sls-credentialstestserver.comein.cn/comein/json_sts_get-sls-credentials
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a customer-facing Comein player SDK and points to its bundled entrypoints.
- The flagged bundle gates telemetry on a Comein-owned page hostname and requires a configured tracker and STS credentials before sending.
- Telemetry includes the Comein user identifier and token; the inspected code sends it only through that gated tracker path.
- The CSS excerpt contains player layout styling.
Evidence against
Behavioral surface
EnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
dist/index.esm.js7.78 MB file, sampled 256 KB
Network
Source & flagged code
6 flagged · loading sourcedist/index.umd.jsView file
1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...
L2: /*!
...
L5: * Released under the MIT License.
L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){...
L7: /**
...
L46: */
L47: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25...
L48: /*!
...
L52: */
L53: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.umd.jsView on unpkg · L147===n&&(n=!1),this.bolSend){e.n=1;break}return e.a(2);case 1:if(r=this.trackers[t]){e.n=2;break}return e.a(2);case 2:if(!this.stsReadyPromise){e.n=6;break}return e.p=3,e.n=4,this.stsReadyPromise;case 4:e.n=6;break;case 5:return e.p=5,e.v,e.a(2);case 6:if(StsOpt.accessKeyId&&StsOpt.accessKeySecret){e.n=7;break}return e.a(2);case 7:r.getOpt().source=location.href.split("?")[0].slice(0,128),o=this.createDefaultData(),s=Object.assi
Low
Ai Review Evidence
The flagged bundle gates telemetry on a Comein-owned page hostname and requires a configured tracker and STS credentials before sending.
dist/index.umd.jsFindings
2 High4 Medium6 Low
HighBrowser Session Account Hijackdist/index.umd.js
HighSemantic Analysis Limiteddist/index.css
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.esm.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.umd.js
LowAi Review Evidencedist/index.umd.js
Affected versions and remediation
This report applies to comein-player-web@0.2.0.
See all versions of comein-player-web for other recorded verdicts.
- Review the evidence and your use of comein-player-web@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.