storysplat-viewer@2.14.3
PlayCanvas-based 3D viewer for StorySplat scenes - HTML export & dynamic embedding
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s runtime analytics sends visitor/session activity with the embedding page’s hostname and referrer to its own service. The README discloses this behavior and provides opt-outs, so this warrants a telemetry warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
Viewer analytics runs during viewer use when analytics context is supplied; `createViewerFromSceneId` supplies that context.
Impact
The service can associate visitor/session activity with the embedding page’s hostname and referrer.
Mechanism
Analytics requests include the embedding hostname and referrer with visitor/session identifiers and are posted to the service tracking endpoint. The README documents the behavior and opt-outs.
AI rationale
The package’s runtime analytics sends visitor/session activity with the embedding page’s hostname and referrer to its own service. The README discloses this behavior and provides opt-outs, so this warrants a telemetry warning rather than a publish block.
Evidence
dist/index.jsREADME.mdpackage.json
Network endpoints1
discover.storysplat.com/api/track-embed
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Analytics payloads include the embedding page’s hostname and referrer, along with visitor and session identifiers.
- Runtime analytics is sent by POST to `/api/track-embed`.
- The README documents viewer analytics and identifies DNT, Global Privacy Control, query-string, and storage opt-outs.
- The analytics API defaults to `https://discover.storysplat.com`; the API URL can be configured through `STORYSPLAT_API_URL` or a window setting.
- The flagged `atob` helper decodes data into a browser Blob URL.
- The manifest has no install hook; `prepublishOnly` runs the build.
Evidence against
- The package is described as a 3D scene viewer, and its network use includes fetching scenes and viewer assets.
- The README discloses the runtime tracking and provides opt-out controls.
- The base64 decoding helper is used to create Blob URLs, not to decode and execute code.
Behavioral surface
DynamicRequireEnvironmentVarsEvalNetwork
Source & flagged code
6 flaggeddist/index.jsView file
1"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L10: * https://github.com/google/material-design-icons/blob/master/LICENSE
L11: */(c);e.querySelectorAll(".storysplat-tour-look-hint-callout--wheel").forEach((e,t)=>{e.textContent=p[t]??""}),h(".storysplat-tour-look-hint-narrow-text--drag",l),h(".storysplat-to...
L12: //# sourceMappingURL=index.js.map
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
dist/index.jsView on unpkg · L1Findings
3 High5 Medium6 Low
HighSame File Env Network Executiondist/index.js
HighBase64 Obscured Urldist/index.js
HighSemantic Analysis Limiteddist/index.esm.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/storysplat-viewer.bundled.umd.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to storysplat-viewer@2.14.3.
See all versions of storysplat-viewer for other recorded verdicts.
- Review the evidence and your use of storysplat-viewer@2.14.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.