registry / @camstack/addon-pipeline / 1.1.15

@camstack/addon-pipeline@1.1.15

CamStack Pipeline bundle — runner, detection, motion, decoders, audio + stream broker. Multi-entry npm package shipping 7 addons under a single bundle.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

WildcardDependency

scanned 41 file(s), 5.40 MB of source, external domains: github.com, huggingface.co, json-schema.org, konvajs.github.io, konvajs.org, module-federation.io, react.dev, www.w3.org

Source & flagged code

8 flagged

dist/audio-analyzer/index.jsView file

Lines 77-117javascript

77 async initialize() {

78 const modelPath = node_path.join(this.modelsDir, "camstack-yamnet.onnx");

79 const labelsPath = node_path.join(this.modelsDir, "camstack-yamnet-labels.json");

80 if (!node_fs.existsSync(modelPath)) {

81 this.log.info("YAMNet ONNX model not found locally — downloading from HuggingFace", { meta: {

82 url: YAMNET_MODEL_URL,

83 dest: modelPath

84 } });

85 await require_model_download_service_C_IHWnXx.downloadFile(YAMNET_MODEL_URL, modelPath);

86 this.log.info("YAMNet ONNX model downloaded", { meta: { sizeBytes: node_fs.statSync(modelPath).size } });

87 }

88 if (!node_fs.existsSync(labelsPath)) {

89 this.log.info("YAMNet labels not found locally — downloading from HuggingFace", { meta: {

90 url: YAMNET_LABELS_URL,

91 dest: labelsPath

92 } });

93 await require_model_download_service_C_IHWnXx.downloadFile(YAMNET_LABELS_URL, labelsPath);

94 }

95 const pythonDir = resolveAudioPythonDir();

96 if (this.installPythonRequirements) await this.installPythonRequirements(node_path.join(pythonDir, "requirements-audio.txt"));

97 const scriptPath = node_path.join(pythonDir, "yamnet_audio.py");

98 const { spawn } = await import("node:child_process");

99 this.process = spawn(this.pythonPath, [

High

Child Process

Package source references child process execution.

dist/audio-analyzer/index.jsView on unpkg · L97

100 scriptPath,

101 "--model",

102 modelPath,

103 "--labels",

104 labelsPath

105 ], { stdio: [

106 "pipe",

107 "pipe",

108 "pipe"

109 ] });

110 this.process.stderr?.on("data", (chunk) => {

111 const text = chunk.toString().trim();

112 if (text) this.log.warn(text);

113 });

114 this.process.on("error", (err) => {

115 this.log.error("YAMNet Python process error", { meta: { error: err.message } });

116 this.pendingReject?.(err);

117 this.pendingReject = null;

dist/dist-CRzS7bK1.jsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-CRzS7bK1.jsView on unpkg · L138

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView file

Lines 2-42javascript

2var __create = Object.create;

3var __defProp = Object.defineProperty;

4var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype

dist/stream-broker/index.mjsView file

12import crypto, { createHash, randomBytes, randomUUID } from "node:crypto"; L13: import { spawn } from "node:child_process"; L14: import * as net$1 from "node:net"; L15: import net from "node:net"; ... L19: import { createSocket } from "node:dgram"; L20: import { lookup } from "node:dns/promises"; L21: import { pathToFileURL } from "node:url"; ... L47: msg: typeof o.msg === "string" ? o.msg : "", L48: data: o.data L49: }; ... L72: try { L73: const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L12

dist/detection-pipeline/index.jsView file

Lines 1-32javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_model_download_service_C_IHWnXx = require("../model-download-service-C-IHWnXx-BnQ_awK4.js");

6const require_dist =

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/postprocessors/yolo_seg.pyView file

•path = python/postprocessors/yolo_seg.py kind = build_helper sizeBytes = 8840 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/postprocessors/yolo_seg.pyView on unpkg

Source & flagged code

8 flagged · loading source

dist/audio-analyzer/index.jsView file

97const scriptPath = node_path.join(pythonDir, "yamnet_audio.py"); L98: const { spawn } = await import("node:child_process"); L99: this.process = spawn(this.pythonPath, [

High

Child Process

Package source references child process execution.

dist/audio-analyzer/index.jsView on unpkg · L97

dist/dist-CRzS7bK1.jsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-CRzS7bK1.jsView on unpkg · L138

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView file

22//#endregion L23: let node_fs = require("node:fs"); L24: node_fs = __toESM(node_fs, 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView on unpkg · L22

dist/stream-broker/index.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L12

dist/detection-pipeline/index.jsView file

12Cross-file remote execution chain: dist/detection-pipeline/index.js spawns dist/model-download-service-C-IHWnXx-BnQ_awK4.js; helper contains network access plus dynamic code execution. L12: node_os = require_model_download_service_C_IHWnXx.__toESM(node_os); L13: let node_child_process = require("node:child_process"); L14: let sharp = require("sharp"); ... L137: return { L138: platform: toKnownPlatform(process.platform), L139: arch: toKnownArch(process.arch), ... L337: ] }); L338: if (!this.process.stdout || !this.process.stdin) throw new Error("PoolWorker: failed to create process pipes"); L339: this.process.stderr?.on("data", (chunk) => { ... L377: } L378: const configBuf = Buffer.from(JSON.stringify(config), "utf8"); L379: this.writeFrame(0, MSG_COMMAND, configBuf);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/detection-pipeline/index.jsView on unpkg · L12

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/postprocessors/yolo_seg.pyView file

•path = python/postprocessors/yolo_seg.py kind = build_helper sizeBytes = 8840 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/postprocessors/yolo_seg.pyView on unpkg

Findings

3 High8 Medium7 Low

HighChild Processdist/audio-analyzer/index.js

HighShell

HighCross File Remote Execution Contextdist/detection-pipeline/index.js

MediumDynamic Requiredist/model-download-service-C-IHWnXx-BnQ_awK4.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryswift/audio-analyzer/apple-sound-classifier

MediumShips Wasm Modulewasm/motion.wasm

MediumShips Build Helperpython/postprocessors/yolo_seg.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/dist-CRzS7bK1.js

LowWeak Cryptodist/stream-broker/index.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

8 flagged

dist/audio-analyzer/index.jsView file

Lines 77-117javascript

77 async initialize() {

78 const modelPath = node_path.join(this.modelsDir, "camstack-yamnet.onnx");

79 const labelsPath = node_path.join(this.modelsDir, "camstack-yamnet-labels.json");

80 if (!node_fs.existsSync(modelPath)) {

81 this.log.info("YAMNet ONNX model not found locally — downloading from HuggingFace", { meta: {

82 url: YAMNET_MODEL_URL,

83 dest: modelPath

84 } });

85 await require_model_download_service_C_IHWnXx.downloadFile(YAMNET_MODEL_URL, modelPath);

86 this.log.info("YAMNet ONNX model downloaded", { meta: { sizeBytes: node_fs.statSync(modelPath).size } });

87 }

88 if (!node_fs.existsSync(labelsPath)) {

89 this.log.info("YAMNet labels not found locally — downloading from HuggingFace", { meta: {

90 url: YAMNET_LABELS_URL,

91 dest: labelsPath

92 } });

93 await require_model_download_service_C_IHWnXx.downloadFile(YAMNET_LABELS_URL, labelsPath);

94 }

95 const pythonDir = resolveAudioPythonDir();

96 if (this.installPythonRequirements) await this.installPythonRequirements(node_path.join(pythonDir, "requirements-audio.txt"));

97 const scriptPath = node_path.join(pythonDir, "yamnet_audio.py");

98 const { spawn } = await import("node:child_process");

99 this.process = spawn(this.pythonPath, [

High

Child Process

Package source references child process execution.

dist/audio-analyzer/index.jsView on unpkg · L97

100 scriptPath,

101 "--model",

102 modelPath,

103 "--labels",

104 labelsPath

105 ], { stdio: [

106 "pipe",

107 "pipe",

108 "pipe"

109 ] });

110 this.process.stderr?.on("data", (chunk) => {

111 const text = chunk.toString().trim();

112 if (text) this.log.warn(text);

113 });

114 this.process.on("error", (err) => {

115 this.log.error("YAMNet Python process error", { meta: { error: err.message } });

116 this.pendingReject?.(err);

117 this.pendingReject = null;

dist/dist-CRzS7bK1.jsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-CRzS7bK1.jsView on unpkg · L138

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView file

Lines 2-42javascript

2var __create = Object.create;

3var __defProp = Object.defineProperty;

4var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype

dist/stream-broker/index.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L12

dist/detection-pipeline/index.jsView file

Lines 1-32javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_model_download_service_C_IHWnXx = require("../model-download-service-C-IHWnXx-BnQ_awK4.js");

6const require_dist =

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/postprocessors/yolo_seg.pyView file

•path = python/postprocessors/yolo_seg.py kind = build_helper sizeBytes = 8840 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/postprocessors/yolo_seg.pyView on unpkg