registry / common-player / 1.0.1

common-player@1.0.1

基于 Jessibuca 的 Vue2 视频播放组件，支持 H265/H264 编码的 WebSocket-FLV、HTTP-FLV 等流媒体播放。安装即用，无需额外配置。

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 842 KB of source, external domains: emscripten.org, github.com, unpkg.com, www.w3.org, www.webrtc-experiment.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-40json

2 "name": "common-player",

3 "version": "1.0.1",

4 "description": "基于 Jessibuca 的 Vue2 视频播放组件，支持 H265/H264 编码的 WebSocket-FLV、HTTP-FLV 等流媒体播放。安装即用，无需额外配置。",

5 "main": "dist/common-player.common.js",

6 "module": "dist/common-player.common.js",

7 "files": [

8 "dist/",

9 "public/js/Jessibuca/jessibuca.js",

10 "public/js/Jessibuca/decoder.js",

11 "public/js/Jessibuca/decoder.wasm",

12 "scripts/",

13 "README.md"

14 ],

15 "scripts": {

16 "serve": "vue-cli-service serve",

17 "build": "vue-cli-service build",

18 "lib": "vue-cli-service build --target lib ./index.js --name common-player --dest dist && node -e \"var fs=require('fs');['dist/package.json','dist/demo.html'].forEach(function(f){if(fs.existsSync(f))fs.unlinkSync(f)})\"",

19 "prepublishOnly": "npm run lib",

20 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 },

22 "keywords": [

23 "jessibuca",

24 "vue",

25 "video-player",

26 "video",

27 "flv",

28 "ws-flv",

29 "http-flv",

30 "h265",

31 "h264",

32 "流媒体",

33 "播放器"

34 ],

35 "author": "XinSC",

36 "license": "ISC",

37 "peerDependencies": {

38 "vue": "^2.6.14"

39 },

40 "dependencies": {

dist/common-player.umd.jsView file

Lines 6963-7003javascript

6963/******/ return getter;

6964/******/ };

6965/******/ })();

6966/******/

6967/******/ /* webpack/runtime/define property getters */

6968/******/ (() => {

6969/******/ // define getter functions for harmony exports

6970/******/ __webpack_require__.d

public/js/Jessibuca/decoder.wasmView file

•path = public/js/Jessibuca/decoder.wasm kind = wasm_module sizeBytes = 1050314 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/js/Jessibuca/decoder.wasmView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/common-player.umd.jsView file

6983/******/ try { L6984: /******/ return this || new Function('return this')(); L6985: /******/ } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/common-player.umd.jsView on unpkg · L6983

public/js/Jessibuca/decoder.wasmView file

•path = public/js/Jessibuca/decoder.wasm kind = wasm_module sizeBytes = 1050314 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/js/Jessibuca/decoder.wasmView on unpkg

Findings

1 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumShips Wasm Modulepublic/js/Jessibuca/decoder.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/common-player.umd.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-40json

2 "name": "common-player",

3 "version": "1.0.1",

4 "description": "基于 Jessibuca 的 Vue2 视频播放组件，支持 H265/H264 编码的 WebSocket-FLV、HTTP-FLV 等流媒体播放。安装即用，无需额外配置。",

5 "main": "dist/common-player.common.js",

6 "module": "dist/common-player.common.js",

7 "files": [

8 "dist/",

9 "public/js/Jessibuca/jessibuca.js",

10 "public/js/Jessibuca/decoder.js",

11 "public/js/Jessibuca/decoder.wasm",

12 "scripts/",

13 "README.md"

14 ],

15 "scripts": {

16 "serve": "vue-cli-service serve",

17 "build": "vue-cli-service build",

19 "prepublishOnly": "npm run lib",

20 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 },

22 "keywords": [

23 "jessibuca",

24 "vue",

25 "video-player",

26 "video",

27 "flv",

28 "ws-flv",

29 "http-flv",

30 "h265",

31 "h264",

32 "流媒体",

33 "播放器"

34 ],

35 "author": "XinSC",

36 "license": "ISC",

37 "peerDependencies": {

38 "vue": "^2.6.14"

39 },

40 "dependencies": {

dist/common-player.umd.jsView file

Lines 6963-7003javascript

6963/******/ return getter;

6964/******/ };

6965/******/ })();

6966/******/

6967/******/ /* webpack/runtime/define property getters */

6968/******/ (() => {

6969/******/ // define getter functions for harmony exports

6970/******/ __webpack_require__.d

public/js/Jessibuca/decoder.wasmView file

•path = public/js/Jessibuca/decoder.wasm kind = wasm_module sizeBytes = 1050314 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/js/Jessibuca/decoder.wasmView on unpkg