registry / @mevdragon/vidfarm-devcli / 0.20.10

@mevdragon/vidfarm-devcli@0.20.10

Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.

Static Scan Results

scanned 13h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 778 KB of source, external domains: api.openai.com, elevenlabs.io, fonts.googleapis.com, generativelanguage.googleapis.com, integrate.api.nvidia.com, openrouter.ai, vidfarm.cc, vidfarm.local

Source & flagged code

4 flagged

dist/src/cli.jsView file

Lines 1920-1960javascript

1920 const rel = path.join("frames", `${slug}.png`);

1921 const target = path.join(input.dir, rel);

1922 if (existsSync(target) && !input.refetch) {

1923 out.set(index, rel);

1924 return;

1925 }

1926 // Sample the scene midpoint, clamped inside the clip.

1927 const mid = scene.start + Math.max(0, scene.duration) / 2;

1928 const seek = Number.isFinite(mid) && mid > 0 ? mid : Math.max(0, scene.start);

1929 const result = spawnSync(ffmpeg, ["-y", "-ss", seek.toFixed(3), "-i", videoPath, "-frames:v", "1", "-q:v", "3", target], { stdio: "ignore" });

1930 if (result.status === 0 && existsSync(target)) {

1931 out.set(index, rel);

1932 }

1933 });

1934 console.log(`[vidfarm] extracted ${out.size}/${input.scenes.length} scene frames from ${input.videoName}`);

1935 return out;

1936}

1937async function resolveFfmpegPath() {

1938 // ffmpeg-static is already a dependency; import lazily so the common path

1939 // (no frame extraction) never pays for it, and degrade gracefully if absent.

1940 try {

1941 const mod = (await import("ffmpeg-static"));

1942 const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L1940

1943 return typeof resolved === "string" && resolved.length > 0 && existsSync(resolved) ? resolved : null;

1944 }

1945 catch {

1946 return null;

1947 }

1948}

1949function safeSize(target) {

1950 try {

1951 return statSync(target).size;

1952 }

1953 catch {

1954 return 0;

1955 }

1956}

1957// Guess a content type from a file name so My Files stores text docs as text/*

1958// (a bare multipart Blob otherwise defaults to application/octet-stream, which

1959// makes browsers download .md/.txt instead of showing them). Mirrors the common

1960// cases of the server's inferAttachmentContentType; returns "" when unknown so

•matchType = previous_version_dangerous_delta matchedPackage = @mevdragon/vidfarm-devcli@0.20.9 matchedIdentity = npm:[redacted]:0.20.9 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/src/cli.jsView file

1940package = @mevdragon/vidfarm-devcli; repositoryIdentity = vidfarm; dependency = ffmpeg-static L1940: try { L1941: const mod = (await import("ffmpeg-static")); L1942: const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L1940

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

Findings

3 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/src/cli.js

HighPayload In Excluded Dir.agents/skills/embedded-captions/scripts/render-and-composite.sh

HighPrevious Version Dangerous Deltadist/src/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.agents/skills/embedded-captions/scripts/render-and-composite.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/src/cli.jsView file

Lines 1920-1960javascript

1920 const rel = path.join("frames", `${slug}.png`);

1921 const target = path.join(input.dir, rel);

1922 if (existsSync(target) && !input.refetch) {

1923 out.set(index, rel);

1924 return;

1925 }

1926 // Sample the scene midpoint, clamped inside the clip.

1927 const mid = scene.start + Math.max(0, scene.duration) / 2;

1928 const seek = Number.isFinite(mid) && mid > 0 ? mid : Math.max(0, scene.start);

1929 const result = spawnSync(ffmpeg, ["-y", "-ss", seek.toFixed(3), "-i", videoPath, "-frames:v", "1", "-q:v", "3", target], { stdio: "ignore" });

1930 if (result.status === 0 && existsSync(target)) {

1931 out.set(index, rel);

1932 }

1933 });

1934 console.log(`[vidfarm] extracted ${out.size}/${input.scenes.length} scene frames from ${input.videoName}`);

1935 return out;

1936}

1937async function resolveFfmpegPath() {

1938 // ffmpeg-static is already a dependency; import lazily so the common path

1939 // (no frame extraction) never pays for it, and degrade gracefully if absent.

1940 try {

1941 const mod = (await import("ffmpeg-static"));

1942 const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L1940

1943 return typeof resolved === "string" && resolved.length > 0 && existsSync(resolved) ? resolved : null;

1944 }

1945 catch {

1946 return null;

1947 }

1948}

1949function safeSize(target) {

1950 try {

1951 return statSync(target).size;

1952 }

1953 catch {

1954 return 0;

1955 }

1956}

1957// Guess a content type from a file name so My Files stores text docs as text/*

1958// (a bare multipart Blob otherwise defaults to application/octet-stream, which

1959// makes browsers download .md/.txt instead of showing them). Mirrors the common

1960// cases of the server's inferAttachmentContentType; returns "" when unknown so

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg