registry / @danonino/starlyn-scraper / 1.2.0

@danonino/starlyn-scraper@1.2.0

Scrapers de descarga y búsqueda para bots de WhatsApp — YouTube, TikTok, Instagram, Facebook, Twitter, Pinterest, MediaFire, GitHub, APK, Google Drive, XNXX, PornHub, XVideos, XHamster, Rule34, Screenshot y más.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

A caller of phDownloadBuffer can cause a remote page's media URL to be interpolated into a shell command. No install-time behavior was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes phDownloadBuffer(url); the fetched page supplies a crafted HLS URL.

Impact

Potential arbitrary command execution with the consuming process's privileges.

Mechanism

Unescaped remote value interpolated into child_process.exec shell command.

Rationale

The package has a concrete remotely influenced shell-injection vulnerability in an exported function, but no evidence of intentional install-time malware or stealthy persistence.

Evidence

package.jsonsrc/index.jssrc/nsfw/phdl.jssrc/scrapers/snaptik.jssrc/nsfw/xhammerdl.jssrc/search/giphy.jssrc/tools/upload.js

Network endpoints1

www.pornhub.com/

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

@danonino/starlyn-scraper@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code