registry / storysplat-viewer / 2.11.2
storysplat-viewer@2.11.2
PlayCanvas-based 3D viewer for StorySplat scenes - HTML export & dynamic embedding
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe static indicators resolve to scene loading, asset handling, and a conditional viewer custom-script feature. The manifest has no install hook, and the inspected source shows no concrete attack behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
No install-time trigger is configured; custom scripts run only when the viewer is initialized with a script and app.
Impact
No confirmed attack impact was established.
Mechanism
The runtime loads scenes from StorySplat, and the reviewed custom-script path filters exposed canvas APIs through a proxy.
AI rationale
The static indicators resolve to scene loading, asset handling, and a conditional viewer custom-script feature. The manifest has no install hook, and the inspected source shows no concrete attack behavior.
Network endpoints1
discover.storysplat.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest configures a prepublish build and declares no install-time hook.
- The CommonJS and ESM runtimes default to StorySplat's scene service; the ESM client also supports a configurable base URL.
- Both browser builds fetch scenes from the StorySplat endpoint.
- Custom scripts require initialized viewer state, a script, and an app; the exposed canvas surface is filtered through a proxy.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryTrivialUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
1"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=h[t]??""}),p(".storysplat-tour-look-hint-narrow-text--drag",l),p(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=h[t]??""}),p(".storysplat-tour-look-hint-narrow-text--drag",l),p(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L1Findings
3 High4 Medium7 Low
HighSame File Env Network Executiondist/index.js
HighBase64 Obscured Urldist/index.js
HighSemantic Analysis Limiteddist/index.esm.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to storysplat-viewer@2.11.2.
See all versions of storysplat-viewer for other recorded verdicts.
- Review the evidence and your use of storysplat-viewer@2.11.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.