Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@jenish094/providers@3.2.9: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / @jenish094/providers / 3.2.9

@jenish094/providers@3.2.9

Package that contains all the providers of p-stream

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Runtime streaming scrapers access browser-stored service tokens and transmit them to provider endpoints while resolving streams. No confirmed install-time payload or host mutation exists.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer builds/runs a token-enabled provider scraper.

Impact

A stored streaming/debrid token can be exposed to the selected provider endpoint.

Mechanism

localStorage token forwarding in streaming API requests

Rationale

Token forwarding to external streaming services warrants a warning because consumers may not expect localStorage credentials to leave the application. The lifecycle hook and base64 URL do not independently establish malicious behavior.

Evidence

package.jsondist/index.js

Network endpoints5

fed.jenish.techmama.up.railway.app/api/showboxtorrentio.strem.funcomet.elfhosted.comcinemaos-v3.vercel.app/api/neo/backendfetch

Decision evidence

public snapshot

with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Suspicious at 83.0% confidence as Dangerous Capability

medium

Evidence for warning

package.json preinstall runs npx -y only-allow pnpm.
dist/index.js reads debrid/febbox tokens from localStorage.
Runtime scrapers include tokens in requests to third-party streaming APIs.
Base64 endpoint decodes to a CinemaOS API URL.

Evidence against

No fs, child_process, shell, VM, or executable loading found.
No import-time network call; fetches occur in scraper functions.
eval references inspect/unpack provider-page scripts rather than execute them.
No persistence, destructive action, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessEvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 543 KB of source, external domains: 1tube.org, anime.aether.mom, animetsu.net, api.1anime.app, api.coitus.ca, api.themoviedb.org, api2.vidsrc.vip, backend.animetsu.net, bombthe.irish, borg.rips.cc, cdn4.zenty.store, challenges.cloudflare.com, cinehdplus.gratis, closeload.top, cloud.mail.ru, comet.elfhosted.com, dinisglows.com, dopebox.to, ee3.me, embed.su, embed.warezcdn.link, fed.jenish.tech, flashstream.cc, fsharetv.co, gemini.aether.mom, graphql.anilist.co, hdrezka.ag, isut.streamflix.one, lmscript.xyz, mama.up.railway.app, mbp.pirxcy.dev, megacloud.store, movies4f.com, moviking.childish2x2.fun, mp4hydra.org, myvidplay.com, play.zephyrflick.top, player.vidify.top, primesrc.me, primewire.pw, proxy.example.com, pupp.slidemovies-dev.workers.dev, rabbitstream.net, rapid-cloud.co, raw.githubusercontent.com, ridomovies.tv, ridoo.net, second.vidnest.fun, soaper.cc, streameeeeee.site

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = npx -y only-allow pnpm

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = npx -y only-allow pnpm

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

2983// src/providers/embeds/cinemaos.ts L2984: var CINEMAOS_API = atob("[redacted]"); L2985: function makeCinemaOSEmbed(server, rank) {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L2983

1803patternName = generic_password severity = medium line = 1803 matchedText = var pass...ng";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1803

982const text = iframeSoup(el).html() || ""; L983: return text.includes("eval(function(p,a,c,k,e,d)"); L984: }).first().html();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L982

dist/index.cjsView file

1846patternName = generic_password severity = medium line = 1846 matchedText = var pass...ng";

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L1846

Findings

2 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urldist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/index.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.cjs

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

83%Warn

Verdict confidence

IntentDangerous Capability

TypeCredential Exfiltration

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Authorj-stream

Maintainersjenish094git

Version3.3.0

PublishedAug 9, 2026

LicenseMIT

Dependencies13

Integrityverified

Package size128 KB

Files7

Keywordsj-streamproviders

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jsmodule → dist/index.mjstypes → dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact568 KB · 7 files1 signature(s)

Install lifecyclepreinstall

Behavioral surface

ChildProcessEvalNetworkHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 82-104json

82 "fuse.js": "^7.1.0",

83 "hls-parser": "^0.13.6",

84 "iso-639-1": "^3.1.5",

85 "json5": "^2.2.3",

86 "nanoid": "^3.3.11",

87 "node-fetch": "^3.3.2",

88 "set-cookie-parser": "^2.7.1",

89 "unpacker": "^1.0.1"

90 },

91 "scripts": {

92 "build": "tsup src/index.ts --format esm,cjs --dts",

93 "cli": "vite-node ./src/dev-cli/index.ts",

94 "test": "vitest run",

95 "test:watch": "vitest",

96 "test:providers": "cross-env MW_TEST_PROVIDERS=true vitest run --reporter verbose",

97 "test:integration": "node ./tests/cjs && node ./tests/esm && node ./tests/browser",

98 "test:coverage": "vitest run --coverage",

99 "lint": "eslint --ext .ts,.js src/",

100 "lint:fix": "eslint --fix --ext .ts,.js src/",

101 "lint:report": "eslint --ext .ts,.js --output-file eslint_report.json --format json src/",

102 "preinstall": "npx -y only-allow pnpm"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L102

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L102

103 }

104}

dist/index.jsView file

Lines 962-1002javascript

962 "Accept-Language": "en-GB,en-US;q=0.9,en;q=0.8",

963 "sec-ch-ua": '"Not A(Brand";v="8", "Chromium";v="132"',

964 "sec-ch-ua-mobile": "?1",

965 "sec-ch-ua-platform": '"Android"',

966 "Sec-Fetch-Dest"

dist/index.cjsView file

Lines 1826-1866javascript

1826 rank: 197,

1827 disabled: true,

1828 flags: [flags.CORS_ALLOWED],

1829 scrapeMovie: comboScraper3,

1830 scrapeShow: comboScraper3

:

"iframe"

,

967 "Sec-Fetch-Mode": "navigate",

968 "Sec-Fetch-Site": "cross-site",

969 "Sec-Fetch-User": "?1",

970 "Upgrade-Insecure-Requests": "1",

971 "User-Agent": userAgent

972 };

973 const response = await ctx.proxiedFetcher(ctx.url, { headers: headers8 });

974 const soup = load2(response);

975 const iframe = soup("iframe").first();

976 if (!iframe.length) throw new NotFoundError("No iframe found");

977 const iframeUrl = iframe.attr("src");

978 if (!iframeUrl) throw new NotFoundError("No iframe src found");

979 const iframeResponse = await ctx.proxiedFetcher(iframeUrl, { headers: headers8 });

980 const iframeSoup = load2(iframeResponse);

981 const jsCode = iframeSoup("script").filter((_, el) => {

982 const text = iframeSoup(el).html() || "";

983 return text.includes("eval(function(p,a,c,k,e,d)");

984 }).first().html();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L982

985 if (!jsCode) throw new NotFoundError("No packed JS code found");

986 const unpacked = unpack(jsCode);

987 if (!unpacked) throw new NotFoundError("Failed to unpack JS code");

988 const videoMatch = unpacked.match(/file:"([^"]+)"/);

989 if (!videoMatch) throw new NotFoundError("No video URL found");

990 const videoUrl = videoMatch[1];

991 return {

992 stream: [

993 {

994 id: "primary",

995 type: "hls",

996 playlist: videoUrl,

997 headers: {

998 Referer: `${new URL(ctx.url).origin}/`,

999 "User-Agent": userAgent

1000 },

1001 flags: [],

1002 captions: []

Lines 1783-1823javascript

1783 rank: 197,

1784 disabled: true,

1785 flags: [flags.CORS_ALLOWED],

1786 scrapeMovie: comboScraper3,

1787 scrapeShow: comboScraper3

1788});

1789var dopeboxEmbeds = [

1790 makeEmbed({

1791 id: "dopebox-upcloud",

1792 name: "UpCloud",

1793 rank: 101,

1794 disabled: true,

1795 flags: [flags.CORS_ALLOWED],

1796 scrape: scrapeUpCloudEmbed

1797 })

1798];

1799

1800// src/providers/sources/ee3/common.ts

1801var apiBaseUrl = "https://borg.rips.cc";

1802var username = "_ps_";

1803var password = "defonotscraping";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1803

1804

1805// src/providers/sources/ee3/index.ts

1806async function fetchMovie(ctx, ee3Auth) {

1807 const authResp = await ctx.proxiedFetcher.full(

1808 `${apiBaseUrl}/api/collections/users/auth-with-password?expand=lists_liked`,

1809 {

1810 method: "POST",

1811 headers: {

1812 Origin: "https://ee3.me",

1813 "Content-Type": "application/json"

1814 },

1815 body: JSON.stringify({

1816 identity: username,

1817 password: ee3Auth

1818 })

1819 }

1820 );

1821 if (authResp.statusCode !== 200) {

1822 throw new Error(`Auth failed with status: ${authResp.statusCode}: ${JSON.stringify(authResp.body)}`);

1823 }

Lines 2963-3003javascript

2963 {

2964 id: "primary",

2965 type: "hls",

2966 playlist: ctx.url,

2967 flags: [flags.CORS_ALLOWED],

2968 captions: []

2969 }

2970 ]

2971 };

2972 }

2973 });

2974}

2975var [

2976 autoembedEnglishScraper,

2977 autoembedHindiScraper,

2978 autoembedBengaliScraper,

2979 autoembedTamilScraper,

2980 autoembedTeluguScraper

2981] = providers2.map(embed2);

2982

2983// src/providers/embeds/cinemaos.ts

2984var CINEMAOS_API = atob("aHR0cHM6Ly9jaW5lbWFvcy12My52ZXJjZWwuYXBwL2FwaS9uZW8vYmFja2VuZGZldGNo");

2985function makeCinemaOSEmbed(server, rank) {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index.jsView on unpkg · L2983

2986 return makeEmbed({

2987 id: `cinemaos-${server}`,

2988 name: `${server.charAt(0).toUpperCase() + server.slice(1)}`,

2989 rank,

2990 flags: [flags.CORS_ALLOWED],

2991 disabled: true,

2992 async scrape(ctx) {

2993 const query = JSON.parse(ctx.url);

2994 const { tmdbId, type, season, episode } = query;

2995 let url = `${CINEMAOS_API}?requestID=${type === "show" ? "tvVideoProvider" : "movieVideoProvider"}&id=${tmdbId}&service=${server}`;

2996 if (type === "show") {

2997 url += `&season=${season}&episode=${episode}`;

2998 }

2999 const res = await ctx.proxiedFetcher(url);

3000 const data = typeof res === "string" ? JSON.parse(res) : res;

3001 const sources = data?.data?.sources;

3002 if (!sources || !Array.isArray(sources) || sources.length === 0) {

3003 throw new NotFoundError("No sources found");

1831

});

1832var dopeboxEmbeds = [

1833 makeEmbed({

1834 id: "dopebox-upcloud",

1835 name: "UpCloud",

1836 rank: 101,

1837 disabled: true,

1838 flags: [flags.CORS_ALLOWED],

1839 scrape: scrapeUpCloudEmbed

1840 })

1841];

1842

1843// src/providers/sources/ee3/common.ts

1844var apiBaseUrl = "https://borg.rips.cc";

1845var username = "_ps_";

1846var password = "defonotscraping";

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L1846

1847

1848// src/providers/sources/ee3/index.ts

1849async function fetchMovie(ctx, ee3Auth) {

1850 const authResp = await ctx.proxiedFetcher.full(

1851 `${apiBaseUrl}/api/collections/users/auth-with-password?expand=lists_liked`,

1852 {

1853 method: "POST",

1854 headers: {

1855 Origin: "https://ee3.me",

1856 "Content-Type": "application/json"

1857 },

1858 body: JSON.stringify({

1859 identity: username,

1860 password: ee3Auth

1861 })

1862 }

1863 );

1864 if (authResp.statusCode !== 200) {

1865 throw new Error(`Auth failed with status: ${authResp.statusCode}: ${JSON.stringify(authResp.body)}`);

1866 }