registry / storysplat-viewer / 2.9.108
storysplat-viewer@2.9.108
⚠ Under reviewPlayCanvas-based 3D viewer for StorySplat scenes - HTML export & dynamic embedding
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryTrivialUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
1"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
...
L9: */
L10: function(e=!0){const t=document.createElement("div");t.className="storysplat-tour-look-hint",t.classList.toggle("storysplat-tour-look-hint--no-keys",!e),t.setAttribute("role","stat...
L11: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11"use strict";var e=require("playcanvas");function t(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var o=Object.getOwnPropertyDescripto...
L2: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L19*/
L10: function(e=!0){const t=document.createElement("div");t.className="storysplat-tour-look-hint",t.classList.toggle("storysplat-tour-look-hint--no-keys",!e),t.setAttribute("role","stat...
L11: //# sourceMappingURL=index.js.map
Low
Findings
2 High4 Medium7 Low
HighSame File Env Network Executiondist/index.js
HighSemantic Analysis Limiteddist/storysplat-viewer.bundled.umd.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to storysplat-viewer@2.9.108.
See all versions of storysplat-viewer for other recorded verdicts.
- Review the evidence and your use of storysplat-viewer@2.9.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.