registry / @hyperframes/engine / 0.7.25

@hyperframes/engine@0.7.25

Seekable web page to video rendering engine (Puppeteer + FFmpeg)

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 35 file(s), 451 KB of source, external domains: hyperframes.local

Source & flagged code

2 flagged

dist/utils/urlDownloader.jsView file

Lines 22-62javascript

22 "[fd", // RFC4193 unique-local IPv6

23];

24// 172.16.0.0 – 172.31.255.255 (RFC1918)

25const BLOCKED_172_RANGE = { min: 16, max: 31 };

26function isBlockedHost(hostname) {

27 const h = hostname.toLowerCase();

28 if (h === "localhost")

29 return true;

30 if (BLOCKED_HOST_PREFIXES.some((p) => h.startsWith(p)))

31 return true;

32 // 172.16–172.31

33 const m = h.match(/^172\.(\d{1,3})\./);

34 if (m) {

35 const octet = parseInt(m[1] ?? "0", 10);

36 if (octet >= BLOCKED_172_RANGE.min && octet <= BLOCKED_172_RANGE.max)

37 return true;

38 }

39 return false;

40}

41/**

42 * Validate that a URL is safe to fetch on behalf of customer-supplied

43 * compositions. Throws if the URL is non-HTTPS or targets a private/reserved

44 * address range (SSRF guard).

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/utils/urlDownloader.jsView on unpkg · L42

45 */

46export function assertPublicHttpsUrl(url) {

47 let parsed;

48 try {

49 parsed = new URL(url);

50 }

51 catch {

52 throw new Error(`[URLDownloader] Invalid URL: ${url}`);

53 }

54 if (parsed.protocol !== "https:") {

55 throw new Error(`[URLDownloader] Only HTTPS URLs are permitted in compositions (got ${parsed.protocol}): ${url}`);

56 }

57 if (isBlockedHost(parsed.hostname)) {

58 throw new Error(`[URLDownloader] URL targets a private/reserved address and is not permitted: ${url}`);

59 }

60}

61function getFilenameFromUrl(url) {

62 const hash = createHash("md5").update(url).digest("hex").slice(0, 12);

dist/services/browserManager.jsView file

Lines 7-47javascript

7import { execSync } from "child_process";

8import { existsSync, readdirSync } from "fs";

9import { join } from "path";

10import { homedir } from "os";

11import { DEFAULT_CONFIG } from "../config.js";

Source & flagged code

2 flagged · loading source

dist/utils/urlDownloader.jsView file

42* Validate that a URL is safe to fetch on behalf of customer-supplied L43: * compositions. Throws if the URL is non-HTTPS or targets a private/reserved L44: * address range (SSRF guard). ... L92: const timeoutId = setTimeout(() => controller.abort(), timeoutMs); L93: const response = await fetch(url, { signal: controller.signal }); L94: clearTimeout(timeoutId);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/utils/urlDownloader.jsView on unpkg · L42

dist/services/browserManager.jsView file

27package = @hyperframes/engine; repositoryIdentity = hyperframes; dependency = puppeteer L27: try { L28: const mod = await import("puppeteer"); L29: _puppeteer = mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/services/browserManager.jsView on unpkg · L27

Findings

1 High3 Medium6 Low

HighCopied Package Dependency Bridgedist/services/browserManager.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/utils/urlDownloader.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/utils/urlDownloader.jsView file

Lines 22-62javascript

22 "[fd", // RFC4193 unique-local IPv6

23];

24// 172.16.0.0 – 172.31.255.255 (RFC1918)

25const BLOCKED_172_RANGE = { min: 16, max: 31 };

26function isBlockedHost(hostname) {

27 const h = hostname.toLowerCase();

28 if (h === "localhost")

29 return true;

30 if (BLOCKED_HOST_PREFIXES.some((p) => h.startsWith(p)))

31 return true;

32 // 172.16–172.31

33 const m = h.match(/^172\.(\d{1,3})\./);

34 if (m) {

35 const octet = parseInt(m[1] ?? "0", 10);

36 if (octet >= BLOCKED_172_RANGE.min && octet <= BLOCKED_172_RANGE.max)

37 return true;

38 }

39 return false;

40}

41/**

42 * Validate that a URL is safe to fetch on behalf of customer-supplied

43 * compositions. Throws if the URL is non-HTTPS or targets a private/reserved

44 * address range (SSRF guard).

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/utils/urlDownloader.jsView on unpkg · L42

45 */

46export function assertPublicHttpsUrl(url) {

47 let parsed;

48 try {

49 parsed = new URL(url);

50 }

51 catch {

52 throw new Error(`[URLDownloader] Invalid URL: ${url}`);

53 }

54 if (parsed.protocol !== "https:") {

55 throw new Error(`[URLDownloader] Only HTTPS URLs are permitted in compositions (got ${parsed.protocol}): ${url}`);

56 }

57 if (isBlockedHost(parsed.hostname)) {

58 throw new Error(`[URLDownloader] URL targets a private/reserved address and is not permitted: ${url}`);

59 }

60}

61function getFilenameFromUrl(url) {

62 const hash = createHash("md5").update(url).digest("hex").slice(0, 12);

dist/services/browserManager.jsView file

Lines 7-47javascript

7import { execSync } from "child_process";

8import { existsSync, readdirSync } from "fs";

9import { join } from "path";

10import { homedir } from "os";

11import { DEFAULT_CONFIG } from "../config.js";