registry / storysplat-viewer / 2.14.2
storysplat-viewer@2.14.2
PlayCanvas-based 3D viewer for StorySplat scenes - HTML export & dynamic embedding
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found no malicious behavior. The flagged dynamic code and encoded bytes belong to the viewer’s optional custom-script feature and bundled byte-table initialization; scene requests and engagement analytics use the product service.
Static reason
One or more suspicious static signals were detected.
Trigger
The caller creates a viewer from a scene ID; analytics is enabled by default unless disabled or explicitly configured.
Impact
No malicious impact was identified; the observed network activity supports scene viewing and engagement analytics.
Mechanism
The viewer fetches the requested scene and reports scene/session engagement metadata to the StorySplat service. The inspected opaque data is used as a byte table, not executable payload.
AI rationale
Source inspection found no malicious behavior. The flagged dynamic code and encoded bytes belong to the viewer’s optional custom-script feature and bundled byte-table initialization; scene requests and engagement analytics use the product service.
Evidence
package.jsondist/index.jsdist/index.esm.jsdist/storysplat-viewer.umd.jsdist/storysplat-viewer.bundled.umd.js.lpm-dependency-evidence-c362ff9a-f80a-4ce0-ae68-6b366056d8f5/0/npm-linux/package.json.lpm-dependency-evidence-c362ff9a-f80a-4ce0-ae68-6b366056d8f5/0/npm-linux/lib/index.js
Network endpoints2
discover.storysplat.com/api/track-embed
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s only publish lifecycle hook runs the build; it declares no install hook.
- The Node, ESM, UMD, and bundled viewer APIs fetch the scene ID supplied by the caller from the configured or default service; an optional API key is sent with that request.
- The scene-ID loader enables analytics unless the caller supplies analytics settings or disables analytics. Analytics records scene/session engagement and sends it to the StorySplat service.
- The bundled base64 value is converted into a byte table used by a deterministic seed generator, not evaluated as code.
- The prepared gifuct-js dependency has no install hook; its inspected runtime source parses GIF data.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
1"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L1Findings
3 High5 Medium6 Low
HighSame File Env Network Executiondist/index.js
HighBase64 Obscured Urldist/index.js
HighSemantic Analysis Limiteddist/index.esm.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/storysplat-viewer.bundled.umd.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to storysplat-viewer@2.14.2.
See all versions of storysplat-viewer for other recorded verdicts.
- Review the evidence and your use of storysplat-viewer@2.14.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.