registry / @mevdragon/vidfarm-devcli / 0.20.9

@mevdragon/vidfarm-devcli@0.20.9

Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.

Static Scan Results

scanned 15h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 774 KB of source, external domains: api.openai.com, elevenlabs.io, fonts.googleapis.com, generativelanguage.googleapis.com, integrate.api.nvidia.com, openrouter.ai, vidfarm.cc, vidfarm.local

Source & flagged code

3 flagged

dist/src/cli.jsView file

Lines 1913-1953javascript

1913 const rel = path.join("frames", `${slug}.png`);

1914 const target = path.join(input.dir, rel);

1915 if (existsSync(target) && !input.refetch) {

1916 out.set(index, rel);

1917 return;

1918 }

1919 // Sample the scene midpoint, clamped inside the clip.

1920 const mid = scene.start + Math.max(0, scene.duration) / 2;

1921 const seek = Number.isFinite(mid) && mid > 0 ? mid : Math.max(0, scene.start);

1922 const result = spawnSync(ffmpeg, ["-y", "-ss", seek.toFixed(3), "-i", videoPath, "-frames:v", "1", "-q:v", "3", target], { stdio: "ignore" });

1923 if (result.status === 0 && existsSync(target)) {

1924 out.set(index, rel);

1925 }

1926 });

1927 console.log(`[vidfarm] extracted ${out.size}/${input.scenes.length} scene frames from ${input.videoName}`);

1928 return out;

1929}

1930async function resolveFfmpegPath() {

1931 // ffmpeg-static is already a dependency; import lazily so the common path

1932 // (no frame extraction) never pays for it, and degrade gracefully if absent.

1933 try {

1934 const mod = (await import("ffmpeg-static"));

1935 const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L1933

1936 return typeof resolved === "string" && resolved.length > 0 && existsSync(resolved) ? resolved : null;

1937 }

1938 catch {

1939 return null;

1940 }

1941}

1942function safeSize(target) {

1943 try {

1944 return statSync(target).size;

1945 }

1946 catch {

1947 return 0;

1948 }

1949}

1950// Guess a content type from a file name so My Files stores text docs as text/*

1951// (a bare multipart Blob otherwise defaults to application/octet-stream, which

1952// makes browsers download .md/.txt instead of showing them). Mirrors the common

1953// cases of the server's inferAttachmentContentType; returns "" when unknown so

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/src/cli.jsView file

1933package = @mevdragon/vidfarm-devcli; repositoryIdentity = vidfarm; dependency = ffmpeg-static L1933: try { L1934: const mod = (await import("ffmpeg-static")); L1935: const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L1933

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

Findings

2 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/src/cli.js

HighPayload In Excluded Dir.agents/skills/embedded-captions/scripts/render-and-composite.sh

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.agents/skills/embedded-captions/scripts/render-and-composite.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

dist/src/cli.jsView file

Lines 1913-1953javascript

1913 const rel = path.join("frames", `${slug}.png`);

1914 const target = path.join(input.dir, rel);

1915 if (existsSync(target) && !input.refetch) {

1916 out.set(index, rel);

1917 return;

1918 }

1919 // Sample the scene midpoint, clamped inside the clip.

1920 const mid = scene.start + Math.max(0, scene.duration) / 2;

1921 const seek = Number.isFinite(mid) && mid > 0 ? mid : Math.max(0, scene.start);

1922 const result = spawnSync(ffmpeg, ["-y", "-ss", seek.toFixed(3), "-i", videoPath, "-frames:v", "1", "-q:v", "3", target], { stdio: "ignore" });

1923 if (result.status === 0 && existsSync(target)) {

1924 out.set(index, rel);

1925 }

1926 });

1927 console.log(`[vidfarm] extracted ${out.size}/${input.scenes.length} scene frames from ${input.videoName}`);

1928 return out;

1929}

1930async function resolveFfmpegPath() {

1931 // ffmpeg-static is already a dependency; import lazily so the common path

1932 // (no frame extraction) never pays for it, and degrade gracefully if absent.

1933 try {

1934 const mod = (await import("ffmpeg-static"));

1935 const resolved = typeof mod === "string" ? mod : mod.default;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/cli.jsView on unpkg · L1933

1936 return typeof resolved === "string" && resolved.length > 0 && existsSync(resolved) ? resolved : null;

1937 }

1938 catch {

1939 return null;

1940 }

1941}

1942function safeSize(target) {

1943 try {

1944 return statSync(target).size;

1945 }

1946 catch {

1947 return 0;

1948 }

1949}

1950// Guess a content type from a file name so My Files stores text docs as text/*

1951// (a bare multipart Blob otherwise defaults to application/octet-stream, which

1952// makes browsers download .md/.txt instead of showing them). Mirrors the common

1953// cases of the server's inferAttachmentContentType; returns "" when unknown so

.agents/skills/embedded-captions/scripts/render-and-composite.shView file

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = payload_in_excluded_dir sizeBytes = 27620 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg

•path = .agents/skills/embedded-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 27620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.agents/skills/embedded-captions/scripts/render-and-composite.shView on unpkg