registry / @serifpersia/dango / 3.6.4

@serifpersia/dango@3.6.4

⚠ Under review

Update dango to get new features/fixes!

A web application for watching anime.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

DownloadedExecutionHighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 167 file(s), 5.46 MB of source, external domains: 0n-kpop.radionetz.de, accounts.google.com, aln.youtube-anime.com, anilight.live, anilist.co, animepahe.pw, animeya.cc, antares.dribbcast.com, aomedia.org, api.aniskip.com, api.github.com, api.mangadex.org, api.themoviedb.org, cdn.listen.moe, clients5.google.com, de1.api.radio-browser.info, discord.com, discord.gg, github.com, gogoanime.lu, google-auth-client.ramiserifpersia.workers.dev, graphql.anilist.co, i.ytimg.com, image.tmdb.org, japaneseasmr.com, kitsu.app, krussdomi.com, listen.moe, mangadex.org, megaplay.buzz, mkissa.to, music.youtube.com, myanimelist.net, nhplayer.com, nl1.api.radio-browser.info, nodejs.org, oauth2.googleapis.com, oppai.stream, quincy.torontocast.com, radio.stereoanime.com, raw.githubusercontent.com, reactrouter.com, registry.npmjs.org, s4.anilist.co, subtitles.vidy.st, uploads.mangadex.org, v3.sg.media-imdb.com, www.dlsite.com, www.googleapis.com, www.imdb.com

Source & flagged code

3 flagged

server/dist/github-sync.jsView file

Lines 6-46javascript

6import { CONFIG } from './config.js';

7import { SHIPPED_DEFAULTS } from './shipped-defaults.js';

8import { exportTables, importTables, MANGA_SYNC_TABLES, TV_SYNC_TABLES, ASMR_SYNC_TABLES, normalizePayload as normalizeGenericPayload, readPayloadVersion, } from './sync-payload.js';

9const log = logger.child({ module: 'GitHubSync' });

10const REPO_NAME = 'dango-sync-data';

11const LEGACY_REPO_NAME = 'aniweb-sync-data';

12const GITHUB_SCOPES = ['repo', 'delete_repo'];

13const GITHUB_API_HEADERS = {

14 accept: 'application/vnd.github+json',

15 'x-github-api-version': '2026-03-10',

16};

17const SYNC_TABLES = [

18 'watchlist',

19 'watched_episodes',

20 'queue',

21 'settings',

22 'shows_meta',

23 'sync_metadata',

24 'dismissed_notifications',

25 'discovered_notifications',

26];

27const nativeImport = new Function('specifier', 'return import(specifier)');

28function getGitHubClientId() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

server/dist/github-sync.jsView on unpkg · L26

29 const id = process.env.GITHUB_CLIENT_ID || SHIPPED_DEFAULTS.GITHUB_CLIENT_ID || '';

30 if (!id) {

31 throw new Error('GITHUB_CLIENT_ID is not configured');

32 }

33 return id;

34}

35function getSyncFilename() {

36 return CONFIG.IS_DEV ? 'sync.dev.json' : 'sync.json';

37}

38function getMangaSyncFilename() {

39 return CONFIG.IS_DEV ? 'manga.sync.dev.json' : 'manga.sync.json';

40}

41function getTvSyncFilename() {

42 return CONFIG.IS_DEV ? 'tv.sync.dev.json' : 'tv.sync.json';

43}

44function getAsmrSyncFilename() {

45 return CONFIG.IS_DEV ? 'asmr.sync.dev.json' : 'asmr.sync.json';

46}

server/dist/providers/remote-loader.jsView file

Lines 371-411javascript

371 continue;

372 const list = value.filter((v) => v.length <= 64).slice(0,

orchestrator.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

orchestrator.js#virtual:normalized:round1View on unpkg

Source & flagged code

3 flagged · loading source

server/dist/github-sync.jsView file

26]; L27: const nativeImport = new Function('specifier', 'return import(specifier)'); L28: function getGitHubClientId() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

server/dist/github-sync.jsView on unpkg · L26

server/dist/providers/remote-loader.jsView file

391const importUrl = `${pathToFileURL(filePath).href}?v=${encodeURIComponent(cacheBuster)}`; L392: mod = (await withTimeout(import(importUrl), FETCH_TIMEOUT_MS, `import ${id}`)); L393: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/providers/remote-loader.jsView on unpkg · L391

orchestrator.js#virtual:normalized:round1View file

Findings

1 High4 Medium7 Low

HighSemantic Analysis Limitedorchestrator.js#virtual:normalized:round1

MediumDynamic Requireserver/dist/providers/remote-loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalserver/dist/github-sync.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @serifpersia/dango@3.6.4.

See all versions of @serifpersia/dango for other recorded verdicts.

Review the evidence and your use of @serifpersia/dango@3.6.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 23:05:47.739Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.