@dinglebear/rytdl@1.1.0

One or more suspicious static signals were detected.

npm installation (postinstall), then CLI invocation

Arbitrary code execution in the installing user's context if the release-base environment is controlled or malicious.

environment-overridable remote native payload download and execution

During npm postinstall, the package builds its binary URL from an environment-overridable release base, downloads an archive and checksum from that same base, extracts it into vendor/, and marks the resulting binary executable. The CLI subsequently executes that binary. An attacker able to influence the install environment can supply both payload and matching checksum, yielding code execution without a pinned trusted checksum or signature.

This package performs unconsented install-time remote native-code acquisition with a caller-controllable source and non-independent integrity check. That forms a concrete postinstall remote-code-execution chain.