registry / @kumix/worker / 0.1.1

@kumix/worker@0.1.1

Kumix Worker is a self-hosted live-stream runner that schedules, loops, and broadcasts video sources to RTMP platforms with monitoring, crash recovery, and a local dashboard.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1.23 MB of source, external domains: 127.0.0.1, app.example.com, base-ui.com, drive.usercontent.google.com, github.com, kumix-worker.local, react.dev, reactrouter.com, worker.local, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

2 "name": "@kumix/worker",

3 "version": "0.1.1",

4 "description": "Kumix Worker is a self-hosted live-stream runner that schedules, loops, and broadcasts video sources to RTMP platforms with monitoring, crash recovery, and a local dashboard.",

5 "author": "Kumix Labs <hai@kumix.io>",

6 "license": "MIT",

7 "type": "module",

8 "main": "./dist/index.js",

9 "bin": {

10 "kumix-worker": "./dist/cli.js"

11 },

12 "scripts": {

13 "clean": "rm -rf dist",

14 "clean:all": "bun run frontend:clean && rm -rf bun.lock coverage dist node_modules",

15 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "copy:public": "rm -rf dist/public && cp -R public dist/",

17 "verify:public": "test -f dist/public/index.html && echo '✓ Public directory copied successfully' || (echo '✗ ERROR: Public directory not copied!' && exit 1)",

18 "frontend:clean": "cd frontend && bun run clean",

19 "frontend:dev": "cd frontend && bun run dev",

20 "frontend:build": "cd frontend && bun run build",

21 "frontend:preview": "cd frontend && bun run preview",

22 "frontend:types:check": "cd frontend && bun run types:check",

23 "dev:api": "node --watch --import tsx src/cli.ts serve --host 0.0.0.0 --port 8080 --dev",

24 "dev": "concurrently -k -n \"worker,vite\" -c \"cyan,green\" \"bun run dev:api\" \"bun run frontend:dev\"",

25 "build": "bun run clean && tsc --noEmit false && bun run fix:esm && bun run frontend:build && bun run copy:public && bun run verify:public",

26 "fix:esm": "node scripts/fix-esm-extensions.mjs",

27 "start": "node dist/cli.js",

28 "lint": "biome check",

29 "lint:fix": "biome check --write --unsafe",

30 "format": "biome format --write",

31 "format:check": "biome check",

32 "types:check": "tsc --noEmit && bun run frontend:types:check",

33 "test": "vitest run",

34 "test:watch": "vitest",

35 "test:coverage": "vitest run --coverage",

dist/runtime/ffmpeg.jsView file

Lines 1-26javascript

1/**

2 * FFmpeg and FFprobe binary resolution and runtime health helpers.

3 */

4import { spawnSync } from "node:child_process";

5import { existsSync } from "node:fs";

6import { createRequire } from "node:module";

7const require =

dist/services/source-downloader.jsView file

Lines 1-23javascript

1/**

2 * Source download, SSRF validation, and post-download probing helpers.

3 */

4import { lookup as dnsLookupCb, setDefaultResultOrder } from "node:dns";

5import { lookup } from "node:dns/promises";

6import { createWriteStream } from "node:fs";

7import { unlink } from

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/runtime/ffmpeg.jsView file

6import { createRequire } from "node:module"; L7: const require = createRequire(import.meta.url); L8: let cachedPaths = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/ffmpeg.jsView on unpkg · L6

dist/services/source-downloader.jsView file

3*/ L4: import { lookup as dnsLookupCb, setDefaultResultOrder } from "node:dns"; L5: import { lookup } from "node:dns/promises"; ... L19: const DEFAULT_MAX_DOWNLOAD_BYTES = 10 * 1024 * 1024 * 1024; // 10 GB L20: const maxDownloadBytes = Number(process.env.KUMIX_WORKER_MAX_DOWNLOAD_BYTES) || DEFAULT_MAX_DOWNLOAD_BYTES; L21: const fetchTimeoutMs = 30_000; ... L49: * DNS resolver used by the undici Agent. It re-checks every resolved address L50: * against the private-range policy and connects only to a vetted IP. Because L51: * the address that passes this check is the exact address used for the socket, ... L455: if (res.ok && contentType.includes("text/html")) { L456: const body = await res.text(); L457: const confirmedUrl = extractGDriveConfirmedUrl(body, fileId, cookie);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/services/source-downloader.jsView on unpkg · L3

Findings

2 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/services/source-downloader.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/runtime/ffmpeg.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

2 "name": "@kumix/worker",

3 "version": "0.1.1",

4 "description": "Kumix Worker is a self-hosted live-stream runner that schedules, loops, and broadcasts video sources to RTMP platforms with monitoring, crash recovery, and a local dashboard.",

5 "author": "Kumix Labs <hai@kumix.io>",

6 "license": "MIT",

7 "type": "module",

8 "main": "./dist/index.js",

9 "bin": {

10 "kumix-worker": "./dist/cli.js"

11 },

12 "scripts": {

13 "clean": "rm -rf dist",

14 "clean:all": "bun run frontend:clean && rm -rf bun.lock coverage dist node_modules",

15 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "copy:public": "rm -rf dist/public && cp -R public dist/",

17 "verify:public": "test -f dist/public/index.html && echo '✓ Public directory copied successfully' || (echo '✗ ERROR: Public directory not copied!' && exit 1)",

18 "frontend:clean": "cd frontend && bun run clean",

19 "frontend:dev": "cd frontend && bun run dev",

20 "frontend:build": "cd frontend && bun run build",

21 "frontend:preview": "cd frontend && bun run preview",

22 "frontend:types:check": "cd frontend && bun run types:check",

23 "dev:api": "node --watch --import tsx src/cli.ts serve --host 0.0.0.0 --port 8080 --dev",

24 "dev": "concurrently -k -n \"worker,vite\" -c \"cyan,green\" \"bun run dev:api\" \"bun run frontend:dev\"",

25 "build": "bun run clean && tsc --noEmit false && bun run fix:esm && bun run frontend:build && bun run copy:public && bun run verify:public",

26 "fix:esm": "node scripts/fix-esm-extensions.mjs",

27 "start": "node dist/cli.js",

28 "lint": "biome check",

29 "lint:fix": "biome check --write --unsafe",

30 "format": "biome format --write",

31 "format:check": "biome check",

32 "types:check": "tsc --noEmit && bun run frontend:types:check",

33 "test": "vitest run",

34 "test:watch": "vitest",

35 "test:coverage": "vitest run --coverage",

dist/runtime/ffmpeg.jsView file

Lines 1-26javascript

1/**

2 * FFmpeg and FFprobe binary resolution and runtime health helpers.

3 */

4import { spawnSync } from "node:child_process";

5import { existsSync } from "node:fs";

6import { createRequire } from "node:module";

7const require =

dist/services/source-downloader.jsView file

Lines 1-23javascript

1/**

2 * Source download, SSRF validation, and post-download probing helpers.

3 */

4import { lookup as dnsLookupCb, setDefaultResultOrder } from "node:dns";

5import { lookup } from "node:dns/promises";

6import { createWriteStream } from "node:fs";

7import { unlink } from