registry / storysplat-viewer / 2.14.1
storysplat-viewer@2.14.1
PlayCanvas-based 3D viewer for StorySplat scenes - HTML export & dynamic embedding
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe scanner signals resolve to viewer features, including custom scripts and analytics with configuration and privacy guards. The manifest has no install-time hook, and the inspected dependency source parses GIF data; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
Using the viewer’s custom-script, scene-guide, or analytics features.
Impact
No harmful effect was established from the inspected source.
Mechanism
The viewer executes custom scripts and makes feature-related network requests; analytics creation depends on supplied configuration and respects privacy controls.
AI rationale
The scanner signals resolve to viewer features, including custom scripts and analytics with configuration and privacy guards. The manifest has no install-time hook, and the inspected dependency source parses GIF data; no concrete attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s only lifecycle hook is prepublishOnly, which runs the build; gifuct-js has no install hook.
- The generated viewer exposes dynamic execution as a custom-script feature and gates analytics on supplied analytics configuration or an explicit disable option.
- Analytics respects browser privacy signals and the analytics-off URL setting in the ESM build.
- The UMD build applies the same privacy checks before analytics.
- The bundled UMD build applies the same privacy checks before analytics.
- gifuct-js parses supplied bytes as GIF data.
Evidence against
- The viewer includes dynamic code generation for custom scripts and network requests for viewer features; inspected source ties these to product behavior, and no concrete attack behavior was identified.
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedTelemetry
Source & flagged code
6 flaggeddist/index.jsView file
1"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L1Findings
3 High5 Medium6 Low
HighSame File Env Network Executiondist/index.js
HighBase64 Obscured Urldist/index.js
HighSemantic Analysis Limiteddist/index.esm.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/storysplat-viewer.bundled.umd.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to storysplat-viewer@2.14.1.
See all versions of storysplat-viewer for other recorded verdicts.
- Review the evidence and your use of storysplat-viewer@2.14.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.