registry / @camstack/addon-pipeline / 1.1.42

@camstack/addon-pipeline@1.1.42

⚠ Under review

CamStack Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

Manifest

WildcardDependency

scanned 45 file(s), 5.81 MB of source, external domains: github.com, huggingface.co, json-schema.org, konvajs.github.io, konvajs.org, module-federation.io, react.dev, www.w3.org

Source & flagged code

10 flagged

dist/pipeline-runner/index.jsView file

Lines 1-29javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_dist = require("../dist-NvwN60Fq.js");

6const require_frame_handle_plane = require("../frame-handle-plane-B3Fxww8H.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pipeline-runner/index.jsView on unpkg · L4

7const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");

8const require_worker_protocol = require("../worker-protocol-BCfO8gUF.js");

9let _camstack_shm_ring = require("@camstack/shm-ring");

10let node_child_process = require("node:child_process");

11let node_url = require("node:url");

High

Child Process

Package source references child process execution.

dist/pipeline-runner/index.jsView on unpkg · L9

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pipeline-runner/index.jsView on unpkg · L9

12//#region src/pipeline-runner/bench-actions.ts

13/**

14* Synthetic-bench custom actions for pipeline-runner.

15*

16* Lets the admin UI drive a production-realistic detection benchmark:

17* the runner — already co-located with detection-pipeline in the

18* `pipeline` group — invokes `api.pipelineExecutor.runPipeline` directly

19* (in-process via localProviderLink, no Moleculer hop), N workers

20* concurrent × M iterations. Returns aggregate stats.

21*

22* Why this exists: the older bench path (UI → benchmark addon → pipeline

23* addon) crosses TWO Moleculer process boundaries that the production

24* camera path does NOT have (broker / runner / detection-pipeline are

25* all in the same group). Running the loop from inside the runner gives

26* fps numbers that match what real cameras achieve.

27*/

28var BenchEngineChoiceSchema = require_dist.object({

29 runtime: require_dist._enum(["node", "python"]),

dist/dist-NvwN60Fq.jsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-NvwN60Fq.jsView on unpkg · L138

dist/stream-broker/index.mjsView file

7import crypto, { createHash, randomBytes, randomUUID } from "node:crypto"; L8: import { spawn } from "node:child_process"; L9: import { pathToFileURL } from "node:url"; ... L14: import { networkInterfaces, tmpdir } from "node:os"; L15: import { lookup } from "node:dns/promises"; L16: import * as net$1 from "node:net"; ... L47: msg: typeof o.msg === "string" ? o.msg : "", L48: data: o.data L49: }; ... L72: try { L73: const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8")); L74: const obj = parsed !== null && typeof parsed === "object" ? parsed : null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L7

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/test_inference_pool_device_selection.pyView file

•path = python/test_inference_pool_device_selection.py kind = build_helper sizeBytes = 8796 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/test_inference_pool_device_selection.pyView on unpkg

assets/reference-audio/synthetic-bark.wavView file

•path = assets/reference-audio/synthetic-bark.wav kind = high_entropy_blob sizeBytes = 64044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/reference-audio/synthetic-bark.wavView on unpkg

dist/detection-pipeline/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @camstack/addon-pipeline@1.1.18 matchedIdentity = npm:[redacted]:1.1.18 similarity = 0.439 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/detection-pipeline/index.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/pipeline-runner/index.jsView file

9let _camstack_shm_ring = require("@camstack/shm-ring"); L10: let node_child_process = require("node:child_process"); L11: let node_url = require("node:url");

High

Child Process

Package source references child process execution.

dist/pipeline-runner/index.jsView on unpkg · L9

9Cross-file remote execution chain: dist/pipeline-runner/index.js spawns dist/dist-NvwN60Fq.js; helper contains network access plus dynamic code execution. L9: let _camstack_shm_ring = require("@camstack/shm-ring"); L10: let node_child_process = require("node:child_process"); L11: let node_url = require("node:url"); ... L46: var CacheBenchFrameInputSchema = require_dist.object({ L47: imageBase64: require_dist.string(), L48: ttlSeconds: require_dist.number().int().positive().optional() ... L618: ...input.packet, L619: data: toWireBytes(input.packet.data) L620: } ... L2829: if (!api) return null; L2830: const hostname = require_hub_hostname.resolveHubHostname(frameSource.hubHostnameOverride, process.env["CAMSTACK_HUB_URL"]); L2831: const plane = new RemoteSourcePlane({

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pipeline-runner/index.jsView on unpkg · L9

4}); L5: const require_dist = require("../dist-NvwN60Fq.js"); L6: const require_frame_handle_plane = require("../frame-handle-plane-B3Fxww8H.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pipeline-runner/index.jsView on unpkg · L4

dist/dist-NvwN60Fq.jsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-NvwN60Fq.jsView on unpkg · L138

dist/stream-broker/index.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L7

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/test_inference_pool_device_selection.pyView file

•path = python/test_inference_pool_device_selection.py kind = build_helper sizeBytes = 8796 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/test_inference_pool_device_selection.pyView on unpkg

assets/reference-audio/synthetic-bark.wavView file

•path = assets/reference-audio/synthetic-bark.wav kind = high_entropy_blob sizeBytes = 64044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/reference-audio/synthetic-bark.wavView on unpkg

dist/detection-pipeline/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/detection-pipeline/index.jsView on unpkg

Findings

1 Critical4 High9 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/detection-pipeline/index.js

HighChild Processdist/pipeline-runner/index.js

HighShell

HighCross File Remote Execution Contextdist/pipeline-runner/index.js

HighShips High Entropy Blobassets/reference-audio/synthetic-bark.wav

MediumDynamic Requiredist/pipeline-runner/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binaryswift/audio-analyzer/apple-sound-classifier

MediumShips Wasm Modulewasm/motion.wasm

MediumShips Build Helperpython/test_inference_pool_device_selection.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/dist-NvwN60Fq.js

LowWeak Cryptodist/stream-broker/index.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

10 flagged

dist/pipeline-runner/index.jsView file

Lines 1-29javascript

1Object.defineProperties(exports, {

2 __esModule: { value: true },

3 [Symbol.toStringTag]: { value: "Module" }

4});

5const require_dist = require("../dist-NvwN60Fq.js");

6const require_frame_handle_plane = require("../frame-handle-plane-B3Fxww8H.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pipeline-runner/index.jsView on unpkg · L4

7const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");

8const require_worker_protocol = require("../worker-protocol-BCfO8gUF.js");

9let _camstack_shm_ring = require("@camstack/shm-ring");

10let node_child_process = require("node:child_process");

11let node_url = require("node:url");

High

Child Process

Package source references child process execution.

dist/pipeline-runner/index.jsView on unpkg · L9

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pipeline-runner/index.jsView on unpkg · L9

12//#region src/pipeline-runner/bench-actions.ts

13/**

14* Synthetic-bench custom actions for pipeline-runner.

15*

16* Lets the admin UI drive a production-realistic detection benchmark:

17* the runner — already co-located with detection-pipeline in the

18* `pipeline` group — invokes `api.pipelineExecutor.runPipeline` directly

19* (in-process via localProviderLink, no Moleculer hop), N workers

20* concurrent × M iterations. Returns aggregate stats.

21*

22* Why this exists: the older bench path (UI → benchmark addon → pipeline

23* addon) crosses TWO Moleculer process boundaries that the production

24* camera path does NOT have (broker / runner / detection-pipeline are

25* all in the same group). Running the loop from inside the runner gives

26* fps numbers that match what real cameras achieve.

27*/

28var BenchEngineChoiceSchema = require_dist.object({

29 runtime: require_dist._enum(["node", "python"]),

dist/dist-NvwN60Fq.jsView file

138try { L139: new Function(""); L140: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-NvwN60Fq.jsView on unpkg · L138

dist/stream-broker/index.mjsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stream-broker/index.mjsView on unpkg · L7

swift/audio-analyzer/apple-sound-classifierView file

•path = swift/audio-analyzer/apple-sound-classifier kind = native_binary sizeBytes = 92712 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

swift/audio-analyzer/apple-sound-classifierView on unpkg

wasm/motion.wasmView file

•path = wasm/motion.wasm kind = wasm_module sizeBytes = 2342 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/motion.wasmView on unpkg

python/test_inference_pool_device_selection.pyView file

•path = python/test_inference_pool_device_selection.py kind = build_helper sizeBytes = 8796 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/test_inference_pool_device_selection.pyView on unpkg

assets/reference-audio/synthetic-bark.wavView file

•path = assets/reference-audio/synthetic-bark.wav kind = high_entropy_blob sizeBytes = 64044 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/reference-audio/synthetic-bark.wavView on unpkg

dist/detection-pipeline/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/detection-pipeline/index.jsView on unpkg