Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@jenish094/providers@3.2.5: Clean npm security report (Allow) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 11 low-signal pattern(s) reviewed.

View on npm All versions

registry / @jenish094/providers / 3.2.5

@jenish094/providers@3.2.5

Package that contains all the providers of p-stream

AI Security Review

scanned 26d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime scrapers make provider-specific media requests; some use browser-stored streaming credentials only when the corresponding scraper runs.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer invokes a selected media scraper

Impact

Returns stream metadata; no install-time or import-time host mutation/exfiltration chain was found

Mechanism

Media-source scraping and credentialed provider requests

Rationale

The flagged primitives are consistent with a browser/server media-provider library. Direct inspection found no concrete malicious execution, persistence, host mutation, or stealth credential-exfiltration behavior.

Evidence

package.jsondist/index.jsdist/index.cjsREADME.md

Network endpoints4

torrentio.strem.funcomet.elfhosted.comfed.jenish.techcinemaos-v3.vercel.app/api/neo/backendfetch

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

as Benign

medium

Evidence for block

package.json has preinstall: npx -y only-allow pnpm
dist/index.js reads streaming/debrid tokens from browser localStorage during scraper calls
dist/index.js forwards a debrid token to configured Torrentio/Comet stream-provider URLs
dist/index.js base64-decodes a CinemaOS API URL for a media-provider request

Evidence against

Preinstall only enforces pnpm; no package file/config mutation is present
No filesystem, child-process, shell, eval execution, or environment harvesting found
Token access is inside named streaming scrapers, not import-time code
Provider requests are activated through scraper functions with media context
The eval hits are string checks/parsing for packed third-party player pages, not eval invocation
Base64 decoding is used for provider payloads/endpoints, not a staged executable payload

Behavioral surface

Source

ChildProcessEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 544 KB of source, external domains: anime.aether.mom, animetsu.net, api.1anime.app, api.coitus.ca, api.themoviedb.org, api2.vidsrc.vip, backend.animetsu.net, bombthe.irish, borg.rips.cc, cdn4.zenty.store, challenges.cloudflare.com, cinehdplus.gratis, closeload.top, cloud.mail.ru, comet.elfhosted.com, dinisglows.com, dopebox.to, ee3.me, embed.su, embed.warezcdn.link, enc-dec.app, fed.jenish.tech, flashstream.cc, fsharetv.co, gemini.aether.mom, graphql.anilist.co, hdrezka.ag, isut.streamflix.one, lmscript.xyz, mama.up.railway.app, mbp.pirxcy.dev, megacloud.store, movies4f.com, moviking.childish2x2.fun, mp4hydra.org, myvidplay.com, play.zephyrflick.top, player.vidify.top, primesrc.me, primewire.pw, proxy.example.com, pupp.slidemovies-dev.workers.dev, rabbitstream.net, rapid-cloud.co, raw.githubusercontent.com, rgshows.ru, ridomovies.tv, ridoo.net, second.vidnest.fun, soaper.cc

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = npx -y only-allow pnpm

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = npx -y only-allow pnpm

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

2982// src/providers/embeds/cinemaos.ts L2983: var CINEMAOS_API = atob("[redacted]"); L2984: function makeCinemaOSEmbed(server, rank) {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L2982

1803patternName = generic_password severity = medium line = 1803 matchedText = var pass...ng";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1803

982const text = iframeSoup(el).html() || ""; L983: return text.includes("eval(function(p,a,c,k,e,d)"); L984: }).first().html();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L982

dist/index.cjsView file

1846patternName = generic_password severity = medium line = 1846 matchedText = var pass...ng";

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L1846

Findings

2 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/index.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.cjs

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

90%Pass

Verdict confidence

IntentBenign

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Authorj-stream

Maintainersjenish094git

Version3.3.0

PublishedAug 7, 2026

LicenseMIT

Dependencies13

Integrityverified

Package size128 KB

Files7

Keywordsj-streamproviders

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jsmodule → dist/index.mjstypes → dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact568 KB · 7 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

ChildProcessEvalNetworkHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 82-104json

82 "fuse.js": "^7.1.0",

83 "hls-parser": "^0.13.6",

84 "iso-639-1": "^3.1.5",

85 "json5": "^2.2.3",

86 "nanoid": "^3.3.11",

87 "node-fetch": "^3.3.2",

88 "set-cookie-parser": "^2.7.1",

89 "unpacker": "^1.0.1"

90 },

91 "scripts": {

92 "build": "tsup src/index.ts --format esm,cjs --dts",

93 "cli": "vite-node ./src/dev-cli/index.ts",

94 "test": "vitest run",

95 "test:watch": "vitest",

96 "test:providers": "cross-env MW_TEST_PROVIDERS=true vitest run --reporter verbose",

97 "test:integration": "node ./tests/cjs && node ./tests/esm && node ./tests/browser",

98 "test:coverage": "vitest run --coverage",

99 "lint": "eslint --ext .ts,.js src/",

100 "lint:fix": "eslint --fix --ext .ts,.js src/",

101 "lint:report": "eslint --ext .ts,.js --output-file eslint_report.json --format json src/",

102 "preinstall": "npx -y only-allow pnpm"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L102

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L102

103 }

104}

dist/index.jsView file

Lines 962-1002javascript

962 "Accept-Language": "en-GB,en-US;q=0.9,en;q=0.8",

963 "sec-ch-ua": '"Not A(Brand";v="8", "Chromium";v="132"',

964 "sec-ch-ua-mobile": "?1",

965 "sec-ch-ua-platform": '"Android"',

966 "Sec-Fetch-Dest"

dist/index.cjsView file

Lines 1826-1866javascript

1826 rank: 197,

1827 disabled: true,

1828 flags: [flags.CORS_ALLOWED],

1829 scrapeMovie: comboScraper3,

1830 scrapeShow: comboScraper3

:

"iframe"

,

967 "Sec-Fetch-Mode": "navigate",

968 "Sec-Fetch-Site": "cross-site",

969 "Sec-Fetch-User": "?1",

970 "Upgrade-Insecure-Requests": "1",

971 "User-Agent": userAgent

972 };

973 const response = await ctx.proxiedFetcher(ctx.url, { headers: headers8 });

974 const soup = load2(response);

975 const iframe = soup("iframe").first();

976 if (!iframe.length) throw new NotFoundError("No iframe found");

977 const iframeUrl = iframe.attr("src");

978 if (!iframeUrl) throw new NotFoundError("No iframe src found");

979 const iframeResponse = await ctx.proxiedFetcher(iframeUrl, { headers: headers8 });

980 const iframeSoup = load2(iframeResponse);

981 const jsCode = iframeSoup("script").filter((_, el) => {

982 const text = iframeSoup(el).html() || "";

983 return text.includes("eval(function(p,a,c,k,e,d)");

984 }).first().html();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L982

985 if (!jsCode) throw new NotFoundError("No packed JS code found");

986 const unpacked = unpack(jsCode);

987 if (!unpacked) throw new NotFoundError("Failed to unpack JS code");

988 const videoMatch = unpacked.match(/file:"([^"]+)"/);

989 if (!videoMatch) throw new NotFoundError("No video URL found");

990 const videoUrl = videoMatch[1];

991 return {

992 stream: [

993 {

994 id: "primary",

995 type: "hls",

996 playlist: videoUrl,

997 headers: {

998 Referer: `${new URL(ctx.url).origin}/`,

999 "User-Agent": userAgent

1000 },

1001 flags: [],

1002 captions: []

Lines 1783-1823javascript

1783 rank: 197,

1784 disabled: true,

1785 flags: [flags.CORS_ALLOWED],

1786 scrapeMovie: comboScraper3,

1787 scrapeShow: comboScraper3

1788});

1789var dopeboxEmbeds = [

1790 makeEmbed({

1791 id: "dopebox-upcloud",

1792 name: "UpCloud",

1793 rank: 101,

1794 disabled: true,

1795 flags: [flags.CORS_ALLOWED],

1796 scrape: scrapeUpCloudEmbed

1797 })

1798];

1799

1800// src/providers/sources/ee3/common.ts

1801var apiBaseUrl = "https://borg.rips.cc";

1802var username = "_ps_";

1803var password = "defonotscraping";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1803

1804

1805// src/providers/sources/ee3/index.ts

1806async function fetchMovie(ctx, ee3Auth) {

1807 const authResp = await ctx.proxiedFetcher.full(

1808 `${apiBaseUrl}/api/collections/users/auth-with-password?expand=lists_liked`,

1809 {

1810 method: "POST",

1811 headers: {

1812 Origin: "https://ee3.me",

1813 "Content-Type": "application/json"

1814 },

1815 body: JSON.stringify({

1816 identity: username,

1817 password: ee3Auth

1818 })

1819 }

1820 );

1821 if (authResp.statusCode !== 200) {

1822 throw new Error(`Auth failed with status: ${authResp.statusCode}: ${JSON.stringify(authResp.body)}`);

1823 }

Lines 2962-3002javascript

2962 {

2963 id: "primary",

2964 type: "hls",

2965 playlist: ctx.url,

2966 flags: [flags.CORS_ALLOWED],

2967 captions: []

2968 }

2969 ]

2970 };

2971 }

2972 });

2973}

2974var [

2975 autoembedEnglishScraper,

2976 autoembedHindiScraper,

2977 autoembedBengaliScraper,

2978 autoembedTamilScraper,

2979 autoembedTeluguScraper

2980] = providers2.map(embed2);

2981

2982// src/providers/embeds/cinemaos.ts

2983var CINEMAOS_API = atob("aHR0cHM6Ly9jaW5lbWFvcy12My52ZXJjZWwuYXBwL2FwaS9uZW8vYmFja2VuZGZldGNo");

2984function makeCinemaOSEmbed(server, rank) {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L2982

2985 return makeEmbed({

2986 id: `cinemaos-${server}`,

2987 name: `${server.charAt(0).toUpperCase() + server.slice(1)}`,

2988 rank,

2989 flags: [flags.CORS_ALLOWED],

2990 disabled: true,

2991 async scrape(ctx) {

2992 const query = JSON.parse(ctx.url);

2993 const { tmdbId, type, season, episode } = query;

2994 let url = `${CINEMAOS_API}?requestID=${type === "show" ? "tvVideoProvider" : "movieVideoProvider"}&id=${tmdbId}&service=${server}`;

2995 if (type === "show") {

2996 url += `&season=${season}&episode=${episode}`;

2997 }

2998 const res = await ctx.proxiedFetcher(url);

2999 const data = typeof res === "string" ? JSON.parse(res) : res;

3000 const sources = data?.data?.sources;

3001 if (!sources || !Array.isArray(sources) || sources.length === 0) {

3002 throw new NotFoundError("No sources found");

1831

});

1832var dopeboxEmbeds = [

1833 makeEmbed({

1834 id: "dopebox-upcloud",

1835 name: "UpCloud",

1836 rank: 101,

1837 disabled: true,

1838 flags: [flags.CORS_ALLOWED],

1839 scrape: scrapeUpCloudEmbed

1840 })

1841];

1842

1843// src/providers/sources/ee3/common.ts

1844var apiBaseUrl = "https://borg.rips.cc";

1845var username = "_ps_";

1846var password = "defonotscraping";

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L1846

1847

1848// src/providers/sources/ee3/index.ts

1849async function fetchMovie(ctx, ee3Auth) {

1850 const authResp = await ctx.proxiedFetcher.full(

1851 `${apiBaseUrl}/api/collections/users/auth-with-password?expand=lists_liked`,

1852 {

1853 method: "POST",

1854 headers: {

1855 Origin: "https://ee3.me",

1856 "Content-Type": "application/json"

1857 },

1858 body: JSON.stringify({

1859 identity: username,

1860 password: ee3Auth

1861 })

1862 }

1863 );

1864 if (authResp.statusCode !== 200) {

1865 throw new Error(`Auth failed with status: ${authResp.statusCode}: ${JSON.stringify(authResp.body)}`);

1866 }