registry / @hyperframes/engine / 0.7.62

@hyperframes/engine@0.7.62

Seekable web page to video rendering engine (Puppeteer + FFmpeg)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 44 file(s), 709 KB of source, external domains: hyperframes.local, www.w3.org

Source & flagged code

3 flagged

dist/utils/urlDownloader.jsView file

Lines 22-62javascript

22 "[fd", // RFC4193 unique-local IPv6

23];

24// 172.16.0.0 – 172.31.255.255 (RFC1918)

25const BLOCKED_172_RANGE = { min: 16, max: 31 };

26function isBlockedHost(hostname) {

27 const h = hostname.toLowerCase();

28 if (h === "localhost")

29 return true;

30 if (BLOCKED_HOST_PREFIXES.some((p) => h.startsWith(p)))

31 return true;

32 // 172.16–172.31

33 const m = h.match(/^172\.(\d{1,3})\./);

34 if (m) {

35 const octet = parseInt(m[1] ?? "0", 10);

36 if (octet >= BLOCKED_172_RANGE.min && octet <= BLOCKED_172_RANGE.max)

37 return true;

38 }

39 return false;

40}

41/**

42 * Validate that a URL is safe to fetch on behalf of customer-supplied

43 * compositions. Throws if the URL is non-HTTPS or targets a private/reserved

44 * address range (SSRF guard).

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/utils/urlDownloader.jsView on unpkg · L42

45 */

46export function assertPublicHttpsUrl(url) {

47 let parsed;

48 try {

49 parsed = new URL(url);

50 }

51 catch {

52 throw new Error(`[URLDownloader] Invalid URL: ${url}`);

53 }

54 if (parsed.protocol !== "https:") {

55 throw new Error(`[URLDownloader] Only HTTPS URLs are permitted in compositions (got ${parsed.protocol}): ${url}`);

56 }

57 if (isBlockedHost(parsed.hostname)) {

58 throw new Error(`[URLDownloader] URL targets a private/reserved address and is not permitted: ${url}`);

59 }

60}

61function getFilenameFromUrl(url) {

62 const hash = createHash("md5").update(url).digest("hex").slice(0, 12);

dist/services/browserManager.jsView file

Lines 9-49javascript

9import { join } from "path";

10import { homedir } from "os";

11import { DEFAULT_CONFIG } from "../config.js";

12import { getSystemTotalMb, LOW_MEMORY_TOTAL_MB_THRESHOLD } from "./systemMemory.js"

Source & flagged code

3 flagged · loading source

dist/utils/urlDownloader.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code