video-core-sdk@1.0.69
Core-SDK 是渲染部分的 SDK，传入工程数据（JSON）可以将数据绘制到 Canvas 上。
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install hook or observed theft behavior, but it exposes browser code-execution primitives driven by rendering data. The minified bundle and unresolved external loader make a clean verdict unsafe.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer renders untrusted project data containing a jscript field or Lottie expression.
Impact
Untrusted project data could execute code in the hosting browser application. No install-time attack or credential theft was confirmed.
Mechanism
Data-driven dynamic module loading and expression evaluation.
AI rationale
The package has no install hook or observed theft behavior, but it exposes browser code-execution primitives driven by rendering data. The minified bundle and unresolved external loader make a clean verdict unsafe.
Evidence
video-core-sdk.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest makes the large browser bundle the default package entry point.
- When rendering data with a jscript field, the bundle sends that value to a global module loader and instantiates the returned module.
- Lottie expression text is concatenated into code and passed to eval.
Evidence against
- package.json contains no lifecycle scripts or dependencies.
- The inspected code is a browser video-rendering bundle; no credential harvesting, persistence, child-process use, or install-time behavior was found.
- The dynamic features are reached from consumer-supplied rendering data rather than automatically at installation.
Behavioral surface
ChildProcessDynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
7 flagged · loading sourcevideo-core-sdk.jsView file
1var __defProp=Object.defineProperty,__defNormalProp=(E,Z,J)=>Z in E?__defProp(E,Z,{enumerable:!0,configurable:!0,writable:!0,value:J}):E[Z]=J,__publicField=(E,Z,J)=>(__defNormalPro...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
video-core-sdk.jsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
video-core-sdk.jsView on unpkg•matchType = normalized_sha256
matchedPackage = video-core-sdk@1.0.34
matchedPath = videoCoreSDK.react.es.min.js
matchedIdentity = npm:dmlkZW8tY29yZS1zZGs:1.0.34
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
video-core-sdk.jsView on unpkgFindings
4 High4 Medium4 Low
HighObfuscated Payload Loadervideo-core-sdk.js
HighSemantic Analysis Limitedvideo-core-sdk.js
HighKnown Malware Source Similarityvideo-core-sdk.js
HighKnown Malware Source Fingerprint Signaturevideo-core-sdk.js
MediumDynamic Requirevideo-core-sdk.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
LowEvalvideo-core-sdk.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to video-core-sdk@1.0.69.
See all versions of video-core-sdk for other recorded verdicts.
- Review the evidence and your use of video-core-sdk@1.0.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.