registry  /  stormcloud-video-player  /  0.8.40

stormcloud-video-player@0.8.40

Ad-first HLS video player with SCTE-35 support and Google IMA integration for precise ad break alignment

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious package attack surface was established. Runtime browser telemetry and advertising integrations are consistent with the advertised ad-supported video-player purpose.

Static reason
One or more suspicious static signals were detected.
Trigger
Consumer initializes the video player with a license key and MQTT enabled; PAL loading occurs when nonce generation is used.
Impact
Sends pseudonymous playback/device-type metrics and ad URLs to the configured advertising service; no host or package-file mutation occurs.
Mechanism
Browser playback telemetry over MQTT and optional Google PAL SDK script loading.
Rationale
Source inspection shows browser-side ad telemetry and SDK loading aligned with the package's stated video advertising function, not a malicious execution or persistence chain. The scanner's network, environment, and secret-pattern signals resolve to normal browser/player code and embedded MQTT configuration.
Evidence
package.jsonlib/utils/tracking.cjslib/utils/mqttConfig.cjslib/utils/mqttClient.cjslib/sdk/pal.cjslib/player/StormcloudVideoPlayer.cjs
Network endpoints3
wss://vecbae77.ala.us-east-1.emqxsl.com:8084/mqttimasdk.googleapis.com/pal/sdkloader/pal.jsadstorm.co/api-adstorm-dev/adstorm/vast/

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • `lib/utils/tracking.cjs` creates a persistent browser/player identifier and publishes playback metrics.
  • `lib/utils/mqttConfig.cjs` contains a default MQTT broker configuration.
  • `lib/sdk/pal.cjs` dynamically loads the Google PAL advertising SDK during nonce generation.
Evidence against
  • `package.json` has only publish-time hooks; no preinstall/install/postinstall hook or bin entry.
  • `lib/utils/tracking.cjs` telemetry is gated on a license key and configured MQTT, and is invoked from player initialization.
  • No Node filesystem, child-process, eval/vm, native binary, credential harvesting, or AI-agent control-surface code was found.
  • Published files are browser video/ad-player modules with source maps; no hidden executable payload was found.
Behavioral surface
Source
ChildProcessEnvironmentVarsNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 29 file(s), 4.49 MB of source, external domains: adstorm.co, imasdk.googleapis.com, live.airy.tv, www.hulu.com, www.iab.net

Source & flagged code

12 flagged · loading source
dist/stormcloud-vp.min.jsView file
3patternName = generic_password severity = medium line = 3 matchedText = var e,t,...)});
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/stormcloud-vp.min.jsView on unpkg · L3
lib/ui/StormcloudVideoPlayer.cjsView file
1890patternName = generic_password severity = medium line = 1890 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/ui/StormcloudVideoPlayer.cjs

lib/ui/StormcloudVideoPlayer.cjsView on unpkg · L1890
lib/players/index.cjsView file
1940patternName = generic_password severity = medium line = 1940 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/players/index.cjs

lib/players/index.cjsView on unpkg · L1940
lib/players/HlsPlayer.cjsView file
1904patternName = generic_password severity = medium line = 1904 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/players/HlsPlayer.cjs

lib/players/HlsPlayer.cjsView on unpkg · L1904
lib/index.jsView file
1875patternName = generic_password severity = medium line = 1875 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/index.js

lib/index.jsView on unpkg · L1875
lib/utils/mqttConfig.cjsView file
113patternName = generic_password severity = medium line = 113 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/utils/mqttConfig.cjs

lib/utils/mqttConfig.cjsView on unpkg · L113
lib/utils/mqttClient.cjsView file
129patternName = generic_password severity = medium line = 129 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/utils/mqttClient.cjs

lib/utils/mqttClient.cjsView on unpkg · L129
lib/utils/tracking.cjsView file
256patternName = generic_password severity = medium line = 256 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/utils/tracking.cjs

lib/utils/tracking.cjsView on unpkg · L256
lib/index.cjsView file
2092patternName = generic_password severity = medium line = 2092 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/index.cjs

lib/index.cjsView on unpkg · L2092
lib/player/StormcloudVideoPlayer.cjsView file
1853patternName = generic_password severity = medium line = 1853 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/player/StormcloudVideoPlayer.cjs

lib/player/StormcloudVideoPlayer.cjsView on unpkg · L1853
lib/player/AdBreakOrchestrator.cjsView file
293patternName = generic_password severity = medium line = 293 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/player/AdBreakOrchestrator.cjs

lib/player/AdBreakOrchestrator.cjsView on unpkg · L293
lib/player/AdConfigManager.cjsView file
1298patternName = generic_password severity = medium line = 1298 matchedText = password...tt",
Medium
Secret Pattern

Hardcoded password in lib/player/AdConfigManager.cjs

lib/player/AdConfigManager.cjsView on unpkg · L1298

Findings

14 Medium4 Low
MediumSecret Patterndist/stormcloud-vp.min.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patternlib/ui/StormcloudVideoPlayer.cjs
MediumSecret Patternlib/players/index.cjs
MediumSecret Patternlib/players/HlsPlayer.cjs
MediumSecret Patternlib/index.js
MediumSecret Patternlib/utils/mqttConfig.cjs
MediumSecret Patternlib/utils/mqttClient.cjs
MediumSecret Patternlib/utils/tracking.cjs
MediumSecret Patternlib/index.cjs
MediumSecret Patternlib/player/StormcloudVideoPlayer.cjs
MediumSecret Patternlib/player/AdBreakOrchestrator.cjs
MediumSecret Patternlib/player/AdConfigManager.cjs
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings