registry / comein-player-web / 0.2.1

comein-player-web@0.2.1

Customer-facing Web SDK built on top of the Comein player SDK.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Source inspection found no lifecycle hooks or confirmed account-hijack behavior. The authentication request is part of the browser SDK's player flow and targets Comein's service by default.

Static reason

No blocking static signals were detected.

Trigger

A consumer invokes the web player with authentication enabled and supplies user information.

Impact

No unrequested account change, credential disclosure to a package-selected unrelated recipient, or install-time behavior was established.

Mechanism

The SDK posts that user information to its channel-login endpoint, using Comein's production or test URL by default and allowing a caller-provided apiBaseUrl.

AI rationale

Source inspection found no lifecycle hooks or confirmed account-hijack behavior. The authentication request is part of the browser SDK's player flow and targets Comein's service by default.

Network endpoints2

server.comein.cn/comeintestserver.comein.cn/comein

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package manifest routes the browser SDK through distribution bundles and contains no lifecycle scripts.
The UMD bundle defaults authentication requests to Comein production or test API hosts.
The ESM flow sends caller-provided user information to the channel-login API; its endpoint uses the caller's apiBaseUrl or the Comein defaults.
The flagged CSS begins with ordinary player layout styles.

Evidence against

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 0 file(s), 512 KB of source, external domains: server.comein.cn, testserver.comein.cn, www.w3.org

Oversized source lightweight scan

dist/index.esm.js7.78 MB file, sampled 256 KB

NetworkHighEntropyStrings

Source & flagged code

6 flagged

dist/index.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa... L2: /*! ... L5: * Released under the MIT License. L6: */var emptyObject=Object.freeze({}),isArray$7=Array.isArray;function isUndef(e){return null==e}function isDef(e){return null!=e}function isTrue(e){return!0===e}function isFalse(e){... L7: /** ... L46: */ L47: return e.mode.CTRGladman=function(){var t=e.lib.BlockCipherMode.extend();function i(e){if(255&~(e>>24))e+=1<<24;else{var t=e>>16&255,i=e>>8&255,n=255&e;255===t?(t=0,255===i?(i=0,25... L48: /*! ... L52: */ L53: function applyMixin(e){if(Number(e.version.split(".")[0])>=2)e.mixin({beforeCreate:i});else{var t=e.prototype._init;e.prototype._init=funct

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

1server.comein.cn/comein",TEST_BASE_URL="https://testserver.comein.cn/comein";class WebSdkAuthError extends Error{constructor(e,t="WEB_SDK_AUTH_FAILED"){super(e),this.name="WebSdkAuthError",this.code=t}}function isStandardUserInfo(e){return Boolean(e&&"object"==typeof e&&(e.token||e.webtoken))}function isBuildEnvironment(e){return"boolean"==typeof e.isBuild&&e.isBuild}function getApiBaseUrl(e){return e.apiBaseUrl||(isBuildEnvironment(e)?FORMAL_BASE_URL:TEST_BASE_URL)}function unwrapResponse(e){const t=Number(e?.errorcode??e?.code??0);i

Low

Ai Review Evidence

The UMD bundle defaults authentication requests to Comein production or test API hosts.

dist/index.umd.jsView on unpkg · L1

dist/index.esm.jsView file

•path = dist/index.esm.js kind = oversized_source_file sizeBytes = 8159242 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.esm.jsView on unpkg

dist/index.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cssView on unpkg

package.jsonView file

Lines 1-28json

2 "name": "comein-player-web",

3 "version": "0.2.1",

4 "description": "Customer-facing Web SDK built on top of the Comein player SDK.",

5 "type": "module",

Source & flagged code

6 flagged · loading source

dist/index.umd.jsView file

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

dist/index.umd.jsView on unpkg · L1

Low

Ai Review Evidence

The UMD bundle defaults authentication requests to Comein production or test API hosts.

Findings

2 High4 Medium6 Low

HighBrowser Session Account Hijackdist/index.umd.js

HighSemantic Analysis Limiteddist/index.css

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.esm.js

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.umd.js

Affected versions and remediation

This report applies to comein-player-web@0.2.1.

See all versions of comein-player-web for other recorded verdicts.

Review the evidence and your use of comein-player-web@0.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 06:42:13.250Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.