registry / @kumix/worker / 0.1.3

@kumix/worker@0.1.3

Kumix Worker is a self-hosted live-stream runner that schedules, loops, and broadcasts video sources to RTMP platforms with monitoring, crash recovery, and a local dashboard.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1.23 MB of source, external domains: 127.0.0.1, app.example.com, base-ui.com, drive.usercontent.google.com, github.com, kumix-worker.local, react.dev, reactrouter.com, worker.local, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

2 "name": "@kumix/worker",

3 "version": "0.1.3",

4 "description": "Kumix Worker is a self-hosted live-stream runner that schedules, loops, and broadcasts video sources to RTMP platforms with monitoring, crash recovery, and a local dashboard.",

5 "author": "Kumix Labs <hai@kumix.io>",

6 "license"

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/runtime/ffmpeg.jsView file

6import { createRequire } from "node:module"; L7: const require = createRequire(import.meta.url); L8: let cachedPaths = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/ffmpeg.jsView on unpkg · L6

dist/services/source-downloader.jsView file

3*/ L4: import { lookup as dnsLookupCb, setDefaultResultOrder } from "node:dns"; L5: import { lookup } from "node:dns/promises"; ... L19: const DEFAULT_MAX_DOWNLOAD_BYTES = 10 * 1024 * 1024 * 1024; // 10 GB L20: const maxDownloadBytes = Number(process.env.KUMIX_WORKER_MAX_DOWNLOAD_BYTES) || DEFAULT_MAX_DOWNLOAD_BYTES; L21: const fetchTimeoutMs = 30_000; ... L49: * DNS resolver used by the undici Agent. It re-checks every resolved address L50: * against the private-range policy and connects only to a vetted IP. Because L51: * the address that passes this check is the exact address used for the socket, ... L455: if (res.ok && contentType.includes("text/html")) { L456: const body = await res.text(); L457: const confirmedUrl = extractGDriveConfirmedUrl(body, fileId, cookie);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/services/source-downloader.jsView on unpkg · L3

Findings

2 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/services/source-downloader.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/runtime/ffmpeg.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/runtime/ffmpeg.jsView file

Lines 1-26javascript

1/**

2 * FFmpeg and FFprobe binary resolution and runtime health helpers.

3 */

4import { spawnSync } from "node:child_process";

5import { existsSync } from "node:fs";

6import { createRequire } from "node:module";

7const require = createRequire(import.meta.url);

8let cachedPaths = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/ffmpeg.jsView on unpkg · L6

9let cachedDetails = null;

10/**

11 * Returns a binary path from an environment variable when it is set and points

12 * to an existing file. Used to let operators override the bundled static

13 * binaries with system FFmpeg/FFprobe (e.g. when the static build cannot

14 * resolve DNS for RTMP output on a host).

15 *

16 * @param envVar - The environment variable name to read.

17 * @returns The verified override path, or null when unset/missing.

18 */

19function envBinaryPath(envVar) {

20 const value = process.env[envVar]?.trim();

21 if (!value)

22 return null;

23 if (!existsSync(value)) {

24 throw new Error(`${envVar} is set to "${value}" but no file exists at that path.`);

25 }

26 return value;

dist/services/source-downloader.jsView file

Lines 1-23javascript

1/**

2 * Source download, SSRF validation, and post-download probing helpers.

3 */

4import { lookup as dnsLookupCb, setDefaultResultOrder } from "node:dns";

5import { lookup } from "node:dns/promises";

6import { createWriteStream } from "node:fs";

7import { unlink } from "node:fs/promises";

8import { isIP } from "node:net";

9import path from "node:path";

10import { Readable } from "node:stream";

11import { pipeline } from "node:stream/promises";

12import { Agent, fetch as undiciFetch } from "undici";

13import { addEvent } from "../db/events.js";

14import { getSource, updateSourceProbe } from "../db/sources.js";

15import { safeFilenamePart } from "../lib/utils.js";

16import { getCacheDir, readSettings } from "../runtime/config.js";

17import { runtimeMetrics } from "../runtime/metrics.js";

18import { probeAndUpdateSource } from "./probe.js";

19const DEFAULT_MAX_DOWNLOAD_BYTES = 10 * 1024 * 1024 * 1024; // 10 GB

20const maxDownloadBytes = Number(process.env.KUMIX_WORKER_MAX_DOWNLOAD_BYTES) || DEFAULT_MAX_DOWNLOAD_BYTES;

21const fetchTimeoutMs = 30_000;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/services/source-downloader.jsView on unpkg · L3

22const downloadTimeoutMs = Number(process.env.KUMIX_WORKER_DOWNLOAD_TIMEOUT_MS) || 60 * 60 * 1000; // 1 hour

23const kumixWorkerUserAgent = "Mozilla/5.0 (compatible; KumixWorker/1.0)";