registry / @camera.ui/server / 2.0.13

@camera.ui/server@2.0.13

⚠ Under review

camera.ui server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 572 file(s), 7.56 MB of source, external domains: 127.0.0.1, 185.97.122.128, 192.168.1.123, alice.yandex.ru, api.github.com, api.npmjs.org, auth.cameraui.com, aws.amazon.com, beispiel.de, billing.cameraui.com, bit.ly, cloud.cameraui.com, cloudflare-dns.com, community.gopro.com, datatracker.ietf.org, developer.apple.com, developer.mozilla.org, devstreaming-cdn.apple.com, discord.gg, dns.google, drmnsamoliu.github.io, en.wikipedia.org, example.com, expr.medv.io, ffmpeg.org, github.com, gopro.github.io, gstreamer.freedesktop.org, help.dvr163.com, home.mi.com, iot.quasar.yandex.ru, iot.tuya.com, json-schema.org, leafletjs.com, medium.com, mjpeg.sanford.io, my.example.com, myhome.novotelecom.ru, openipc.org, proxy.cameraui.com, raw.githubusercontent.com, react-dnd.github.io, reddit.com, registry.npmjs.org, rolldown.rs, share.cameraui.com, support.wyze.com, tv.ivideon.com, www.apache.org, www.aqara.com

Source & flagged code

8 flagged

dist/server/src/remote/push.jsView file

Lines 1-36javascript

1import { PushReceiver } from '@eneris/push-receiver';

2import { EventEmitter } from 'node:events';

3import { RemoteService } from '../api/services/remote.service.js';

4export class PushService extends EventEmitter {

5 remoteService;

6 pushReceiver;

7 registrationIdPromise = Promise.withResolvers();

8 _connected = false;

9 connectionPromise = null;

10 constructor() {

11 super();

12 this.remoteService = new RemoteService();

13 this.pushReceiver = new PushReceiver({

14 ...this.getPushReceiverConfig(),

15 firebase: {

16 apiKey: 'AIzaSyDItp2IsB99y12LFz8tYu9xJvuu81CwT5o',

High

High Secret

Package contains a high-severity secret pattern.

dist/server/src/remote/push.jsView on unpkg · L16

High

Secret Pattern

Google API key in dist/server/src/remote/push.js

dist/server/src/remote/push.jsView on unpkg · L16

17 authDomain: 'camera-ui-auth.firebaseapp.com',

18 projectId: 'camera-ui-auth',

19 storageBucket: 'camera-ui-auth.firebasestorage.app',

20 messagingSenderId: '572971064517',

21 appId: '1:572971064517:web:d56fbf6fb7ad3d501864ac',

22 measurementId: 'G-LTBRW89JEH',

23 },

24 heartbeatIntervalMs: 15 * 60 * 1000,

25 });

26 this.pushReceiver.onCredentialsChanged(({ newCredentials }) => {

27 const config = this.getPushReceiverConfig();

28 config.credentials = newCredentials;

29 this.savePushReceiverConfig(config);

30 if (newCredentials.fcm?.token) {

31 this.registrationIdPromise.resolve(newCredentials.fcm.token);

32 }

33 });

34 this.pushReceiver.onNotification(({ message }) => {

35 const config = this.getPushReceiverConfig();

36 config.persistentIds = this.pushReceiver.persistentIds;

dist/interface/assets/worker-base-ybazWkNy.jsView file

Lines 31-71javascript

32window.normalizeModule = function(parentId, moduleName) {

33 // normalize plugin requires

34 if (moduleName.indexOf("!") !== -1) {

35 var chunks = moduleName.

dist/server/src/camera/sensors/stable-id.jsView file

Lines 1-13javascript

1import { createHash } from 'node:crypto';

2export function computeSensorStableId(pluginId, sensorType, sensorName) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/src/camera/sensors/stable-id.jsView on unpkg · L1

3 const hash = createHash(

dist/interface/assets/vendor-primevue-BdB7McKg.jsView file

3372contains invisible/control Unicode U+FEFF (zero width no-break space) In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Rp(e,t){if(e){if(typeof e==`string`)return Vp(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/interface/assets/vendor-primevue-BdB7McKg.jsView on unpkg · L3372

dist/server/src/plugins/runtime/python/store.pyView file

•path = [redacted].py kind = build_helper sizeBytes = 17689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/src/plugins/runtime/python/store.pyView on unpkg

dist/interface/fonts/InterVariable.woff2View file

•path = [redacted].woff2 kind = high_entropy_blob sizeBytes = 352240 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/interface/fonts/InterVariable.woff2View on unpkg

dist/interface/assets/Cameras-DT62fcZK.jsView file

Lines 519-559javascript

519

520- H.264 and H.265 video codec support

521- AAC, G.711, PCM, and Opus audio codec support

522- Two-way audio (intercom) support

523- Resolution switching (

Source & flagged code

8 flagged · loading source

dist/server/src/remote/push.jsView file

16patternName = google_api_key severity = high line = 16 matchedText = apiKey: ...5o',

High

High Secret

Package contains a high-severity secret pattern.

dist/server/src/remote/push.jsView on unpkg · L16

16patternName = google_api_key severity = high line = 16 matchedText = apiKey: ...5o',

High

Secret Pattern

Google API key in dist/server/src/remote/push.js

dist/server/src/remote/push.jsView on unpkg · L16

dist/interface/assets/worker-base-ybazWkNy.jsView file

51L52: window.require = function require(parentId, id) { L53: if (!id) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/interface/assets/worker-base-ybazWkNy.jsView on unpkg · L51

dist/server/src/camera/sensors/stable-id.jsView file

1import { createHash } from 'node:crypto'; L2: export function computeSensorStableId(pluginId, sensorType, sensorName) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/src/camera/sensors/stable-id.jsView on unpkg · L1

dist/interface/assets/vendor-primevue-BdB7McKg.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/interface/assets/vendor-primevue-BdB7McKg.jsView on unpkg · L3372

dist/server/src/plugins/runtime/python/store.pyView file

•path = [redacted].py kind = build_helper sizeBytes = 17689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/src/plugins/runtime/python/store.pyView on unpkg

dist/interface/fonts/InterVariable.woff2View file

•path = [redacted].woff2 kind = high_entropy_blob sizeBytes = 352240 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/interface/fonts/InterVariable.woff2View on unpkg

dist/interface/assets/Cameras-DT62fcZK.jsView file

539patternName = generic_password severity = medium line = 539 matchedText = password...efix

Medium

Secret Pattern

Hardcoded password in dist/interface/assets/Cameras-DT62fcZK.js

dist/interface/assets/Cameras-DT62fcZK.jsView on unpkg · L539

Findings

1 Critical3 High7 Medium7 Low

CriticalTrojan Source Unicodedist/interface/assets/vendor-primevue-BdB7McKg.js

HighHigh Secretdist/server/src/remote/push.js

HighShips High Entropy Blobdist/interface/fonts/InterVariable.woff2

HighSecret Patterndist/server/src/remote/push.js

MediumDynamic Requiredist/interface/assets/worker-base-ybazWkNy.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperdist/server/src/plugins/runtime/python/store.py

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/interface/assets/Cameras-DT62fcZK.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/server/src/camera/sensors/stable-id.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/server/src/remote/push.jsView file

Lines 1-36javascript

1import { PushReceiver } from '@eneris/push-receiver';

2import { EventEmitter } from 'node:events';

3import { RemoteService } from '../api/services/remote.service.js';

4export class PushService extends EventEmitter {

5 remoteService;

6 pushReceiver;

7 registrationIdPromise = Promise.withResolvers();

8 _connected = false;

9 connectionPromise = null;

10 constructor() {

11 super();

12 this.remoteService = new RemoteService();

13 this.pushReceiver = new PushReceiver({

14 ...this.getPushReceiverConfig(),

15 firebase: {

16 apiKey: 'AIzaSyDItp2IsB99y12LFz8tYu9xJvuu81CwT5o',

High

High Secret

Package contains a high-severity secret pattern.

dist/server/src/remote/push.jsView on unpkg · L16

High

Secret Pattern

Google API key in dist/server/src/remote/push.js

dist/server/src/remote/push.jsView on unpkg · L16

17 authDomain: 'camera-ui-auth.firebaseapp.com',

18 projectId: 'camera-ui-auth',

19 storageBucket: 'camera-ui-auth.firebasestorage.app',

20 messagingSenderId: '572971064517',

21 appId: '1:572971064517:web:d56fbf6fb7ad3d501864ac',

22 measurementId: 'G-LTBRW89JEH',

23 },

24 heartbeatIntervalMs: 15 * 60 * 1000,

25 });

26 this.pushReceiver.onCredentialsChanged(({ newCredentials }) => {

27 const config = this.getPushReceiverConfig();

28 config.credentials = newCredentials;

29 this.savePushReceiverConfig(config);

30 if (newCredentials.fcm?.token) {

31 this.registrationIdPromise.resolve(newCredentials.fcm.token);

32 }

33 });

34 this.pushReceiver.onNotification(({ message }) => {

35 const config = this.getPushReceiverConfig();

36 config.persistentIds = this.pushReceiver.persistentIds;

dist/interface/assets/worker-base-ybazWkNy.jsView file

Lines 31-71javascript

32window.normalizeModule = function(parentId, moduleName) {

33 // normalize plugin requires

34 if (moduleName.indexOf("!") !== -1) {

35 var chunks = moduleName.

dist/server/src/camera/sensors/stable-id.jsView file

Lines 1-13javascript

1import { createHash } from 'node:crypto';

2export function computeSensorStableId(pluginId, sensorType, sensorName) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/src/camera/sensors/stable-id.jsView on unpkg · L1

3 const hash = createHash(

dist/interface/assets/vendor-primevue-BdB7McKg.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/interface/assets/vendor-primevue-BdB7McKg.jsView on unpkg · L3372

dist/server/src/plugins/runtime/python/store.pyView file

•path = [redacted].py kind = build_helper sizeBytes = 17689 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/src/plugins/runtime/python/store.pyView on unpkg

dist/interface/fonts/InterVariable.woff2View file

•path = [redacted].woff2 kind = high_entropy_blob sizeBytes = 352240 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/interface/fonts/InterVariable.woff2View on unpkg

dist/interface/assets/Cameras-DT62fcZK.jsView file

Lines 519-559javascript

519

520- H.264 and H.265 video codec support

521- AAC, G.711, PCM, and Opus audio codec support

522- Two-way audio (intercom) support

523- Resolution switching (