registry / @derimalec/ytdl-to-mp3 / 3.0.0

@derimalec/ytdl-to-mp3@3.0.0

Youtube videos downloader - supports both video downloads and audio conversion (MP3, WAV, AAC)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A download request initializes `youtubei.js` and installs an eval shim that executes `data.output` with `new Function`. This is a runtime dynamic-code-execution surface, not install-time behavior.

Static reason

No blocking static signals were detected.

Trigger

Calling `Downloader.download()` or `downloadAudio()` with a YouTube URL.

Impact

Code supplied to the shim could execute with the host Node process permissions.

Mechanism

Unvalidated dynamic JavaScript execution through a `youtubei.js` eval shim.

Rationale

No concrete malicious chain was found, but runtime `new Function(data.output)()` creates a meaningful unvalidated code-execution surface. Downgrade to warn rather than block because it is user-triggered and package-aligned, with no stealth, persistence, or exfiltration observed.

Evidence

package.jsonlib/index.jslib/core/index.jsREADME.md

Network endpoints1

www.youtube.com

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

@derimalec/ytdl-to-mp3@3.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code