registry / storysplat-viewer / 2.14.0
storysplat-viewer@2.14.0
PlayCanvas-based 3D viewer for StorySplat scenes - HTML export & dynamic embedding
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected source ties the scanner's dynamic execution and encoded-data signals to scene scripting and graphics behavior. The package has no install lifecycle hook, and the inspected dependency entrypoint performs GIF parsing; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer imports or uses the viewer to load a scene.
Impact
No package-controlled credential transfer, install-time mutation, or other attack effect was established.
Mechanism
The viewer requests scene data from its configured API base; scene-provided custom scripts run through the viewer scripting feature.
AI rationale
The inspected source ties the scanner's dynamic execution and encoded-data signals to scene scripting and graphics behavior. The package has no install lifecycle hook, and the inspected dependency entrypoint performs GIF parsing; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest defines a prepublishOnly build hook and no install lifecycle hook.
- The viewer fetches a scene from its configured API base and attaches an API key supplied in the caller's options to that request.
- Scene configuration supplies the custom script; the viewer runs it through its custom scripting feature and exposes a limited viewer API.
- The bundled encoded bytes initialize a seeded byte-table generator used by the graphics bundle.
- The included gifuct-js dependency has no install hook in its manifest and its inspected entrypoint parses GIF data from an ArrayBuffer.
Evidence against
- The dynamic code generation is part of the scene custom-script feature, and the base64 data is used by a graphics random-number generator; neither inspected behavior establishes a package-controlled attack.
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/index.jsView file
1"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L1Findings
3 High5 Medium6 Low
HighSame File Env Network Executiondist/index.js
HighBase64 Obscured Urldist/index.js
HighSemantic Analysis Limiteddist/index.esm.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/storysplat-viewer.bundled.umd.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to storysplat-viewer@2.14.0.
See all versions of storysplat-viewer for other recorded verdicts.
- Review the evidence and your use of storysplat-viewer@2.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.