registry / Remote code execution / @dinglebear/rytdl
@dinglebear/rytdl
yt-dlp search, download, metadata, delivery, and Plex workflows over MCP and CLI.
This report shows the evidence for @dinglebear/rytdl@1.1.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package performs unconsented install-time remote native-code acquisition with a caller-controllable source and non-independent integrity check. That forms a concrete postinstall remote-code-execution chain.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation (postinstall), then CLI invocation
Impact
Arbitrary code execution in the installing user's context if the release-base environment is controlled or malicious.
Mechanism
environment-overridable remote native payload download and execution
Attack narrative
During npm postinstall, the package builds its binary URL from an environment-overridable release base, downloads an archive and checksum from that same base, extracts it into vendor/, and marks the resulting binary executable. The CLI subsequently executes that binary. An attacker able to influence the install environment can supply both payload and matching checksum, yielding code execution without a pinned trusted checksum or signature.
AI rationale
This package performs unconsented install-time remote native-code acquisition with a caller-controllable source and non-independent integrity check. That forms a concrete postinstall remote-code-execution chain.
Evidence
package.jsonscripts/install.jslib/platform.jsbin/rytdl.jsvendor/
Network endpoints1
github.com/dinglebear-ai/rytdl/releases/download
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- postinstall runs a downloader during npm installation.
- Downloader permits YTDL_RMCP_RELEASE_BASE_URL to replace the release host.
- Downloaded archive is executed as a native binary after extraction; checksum is fetched from the same mutable host.
Evidence against
- No credential harvesting, exfiltration, or AI-agent configuration writes appear in the inspected JavaScript.
- Default endpoint is the package's declared GitHub release path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/rytdl.jsView file
3L4: const fs = require("node:fs");
L5: const path = require("node:path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/rytdl.jsView on unpkg · L3Findings
1 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/rytdl.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @dinglebear/rytdl@1.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @dinglebear/rytdl@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.