registry / @camstack/addon-pipeline / 1.1.22

@camstack/addon-pipeline@1.1.22

⚠ Under review

CamStack Pipeline bundle — runner, detection, motion, decoders, audio + stream broker. Multi-entry npm package shipping 7 addons under a single bundle.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

WildcardDependency

scanned 41 file(s), 5.60 MB of source, external domains: github.com, huggingface.co, json-schema.org, konvajs.github.io, konvajs.org, module-federation.io, react.dev, www.w3.org

Source & flagged code

9 flagged

dist/audio-codec-ffmpeg/index.jsView file

Lines 1-26javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_dist = require("../dist-CE3a05qT.js");

6let node_crypto = require("node:crypto");

7let node_child_process = require("node:child_process");

8//#region src/audio-codec-ffmpeg/ffmpeg-audio-process.ts

High

Child Process

Package source references child process execution.

dist/audio-codec-ffmpeg/index.jsView on unpkg · L6

9/**

10* Minimal ffmpeg subprocess wrapper shared by the audio decode + encode

11* sessions of `audio-codec-ffmpeg`.

12*

13* Owns exactly the process concerns both directions need: spawn, stdin write

14* with tolerated backpressure, stdout chunk delivery, and the kill sequence.

15*

16* The kill logic copies the CORRECTED pattern from `decoder-ffmpeg`'s

17* `killFfmpeg`: SIGTERM, then SIGKILL after a grace — gated on

18* `exitCode === null && signalCode === null`, NOT on `child.killed` (which Node

19* sets true after ANY `kill()`, so `!child.killed` never fires and the SIGKILL

20* would leak the process).

21*/

22/** Grace period between SIGTERM and the escalated SIGKILL. */

23var KILL_GRACE_MS = 500;

24var FfmpegAudioProcess = class {

25 child = null;

26 logger;

dist/dist-pd_-3C0T.mjsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-pd_-3C0T.mjsView on unpkg · L138

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView file

Lines 2-42javascript

2var __create = Object.create;

3var __defProp = Object.defineProperty;

4var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype

dist/stream-broker/index.mjsView file

12import crypto, { createHash, randomBytes, randomUUID } from "node:crypto"; L13: import { spawn } from "node:child_process"; L14: import { lookup } from "node:dns/promises"; L15: import { pathToFileURL } from "node:url"; ... L47: msg: typeof o.msg === "string" ? o.msg : "", L48: data: o.data L49: }; ... L72: try { L73: const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8")); L74: const obj = parsed !== null && typeof parsed === "object" ? parsed : null; ... L629: * Spawns `ffmpeg ... -f mpegts pipe:1` (argv supplied by the caller) and L630: * demuxes ffmpeg's MPEG-TS stdout back into per-access-unit `EncodedPacket`s

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L12

dist/detection-pipeline/index.jsView file

Lines 1-32javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_model_download_service_C_IHWnXx = require("../model-download-service-C-IHWnXx-BnQ_awK4.js");

6const require_dist =

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/postprocessors/yolo_seg.pyView file

•path = python/postprocessors/yolo_seg.py kind = build_helper sizeBytes = 8840 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/postprocessors/yolo_seg.pyView on unpkg

dist/stream-broker/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @camstack/addon-pipeline@1.1.18 matchedIdentity = npm:[redacted]:1.1.18 similarity = 0.683 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/stream-broker/index.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/audio-codec-ffmpeg/index.jsView file

6let node_crypto = require("node:crypto"); L7: let node_child_process = require("node:child_process"); L8: //#region src/audio-codec-ffmpeg/ffmpeg-audio-process.ts

High

Child Process

Package source references child process execution.

dist/audio-codec-ffmpeg/index.jsView on unpkg · L6

dist/dist-pd_-3C0T.mjsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-pd_-3C0T.mjsView on unpkg · L138

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView file

22//#endregion L23: let node_fs = require("node:fs"); L24: node_fs = __toESM(node_fs, 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView on unpkg · L22

dist/stream-broker/index.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L12

dist/detection-pipeline/index.jsView file

12Cross-file remote execution chain: dist/detection-pipeline/index.js spawns dist/model-download-service-C-IHWnXx-BnQ_awK4.js; helper contains network access plus dynamic code execution. L12: node_os = require_model_download_service_C_IHWnXx.__toESM(node_os); L13: let node_child_process = require("node:child_process"); L14: let sharp = require("sharp"); ... L137: return { L138: platform: toKnownPlatform(process.platform), L139: arch: toKnownArch(process.arch), ... L337: ] }); L338: if (!this.process.stdout || !this.process.stdin) throw new Error("PoolWorker: failed to create process pipes"); L339: this.process.stderr?.on("data", (chunk) => { ... L377: } L378: const configBuf = Buffer.from(JSON.stringify(config), "utf8"); L379: this.writeFrame(0, MSG_COMMAND, configBuf);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/detection-pipeline/index.jsView on unpkg · L12

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/postprocessors/yolo_seg.pyView file

•path = python/postprocessors/yolo_seg.py kind = build_helper sizeBytes = 8840 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/postprocessors/yolo_seg.pyView on unpkg

dist/stream-broker/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/stream-broker/index.jsView on unpkg

Findings

1 Critical3 High8 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/stream-broker/index.js

HighChild Processdist/audio-codec-ffmpeg/index.js

HighShell

HighCross File Remote Execution Contextdist/detection-pipeline/index.js

MediumDynamic Requiredist/model-download-service-C-IHWnXx-BnQ_awK4.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryswift/audio-analyzer/apple-sound-classifier

MediumShips Wasm Modulewasm/motion.wasm

MediumShips Build Helperpython/postprocessors/yolo_seg.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/dist-pd_-3C0T.mjs

LowWeak Cryptodist/stream-broker/index.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

9 flagged

dist/audio-codec-ffmpeg/index.jsView file

Lines 1-26javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_dist = require("../dist-CE3a05qT.js");

6let node_crypto = require("node:crypto");

7let node_child_process = require("node:child_process");

8//#region src/audio-codec-ffmpeg/ffmpeg-audio-process.ts

High

Child Process

Package source references child process execution.

dist/audio-codec-ffmpeg/index.jsView on unpkg · L6

9/**

10* Minimal ffmpeg subprocess wrapper shared by the audio decode + encode

11* sessions of `audio-codec-ffmpeg`.

12*

13* Owns exactly the process concerns both directions need: spawn, stdin write

14* with tolerated backpressure, stdout chunk delivery, and the kill sequence.

15*

16* The kill logic copies the CORRECTED pattern from `decoder-ffmpeg`'s

17* `killFfmpeg`: SIGTERM, then SIGKILL after a grace — gated on

18* `exitCode === null && signalCode === null`, NOT on `child.killed` (which Node

19* sets true after ANY `kill()`, so `!child.killed` never fires and the SIGKILL

20* would leak the process).

21*/

22/** Grace period between SIGTERM and the escalated SIGKILL. */

23var KILL_GRACE_MS = 500;

24var FfmpegAudioProcess = class {

25 child = null;

26 logger;

dist/dist-pd_-3C0T.mjsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-pd_-3C0T.mjsView on unpkg · L138

dist/model-download-service-C-IHWnXx-BnQ_awK4.jsView file

Lines 2-42javascript

2var __create = Object.create;

3var __defProp = Object.defineProperty;

4var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype

dist/stream-broker/index.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L12

dist/detection-pipeline/index.jsView file

Lines 1-32javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_model_download_service_C_IHWnXx = require("../model-download-service-C-IHWnXx-BnQ_awK4.js");

6const require_dist =

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/postprocessors/yolo_seg.pyView file

•path = python/postprocessors/yolo_seg.py kind = build_helper sizeBytes = 8840 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/postprocessors/yolo_seg.pyView on unpkg

dist/stream-broker/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/stream-broker/index.jsView on unpkg