channel-worker@2.5.108
Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
Channel Manager worker daemon — runs on remote machines to execute video pipeline jobs
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected source has no install lifecycle hook, and pairing, command polling, and self-updating are consistent with the described worker. Scanner signals for dynamic loading and child processes resolve to CLI startup and package-aligned updater behavior; no concrete attack surface was established.
Decision evidence
public snapshot- package.json defines start and dev commands but no install lifecycle hook.
- Pairing sends a supplied one-time code to the configured worker API and saves the returned worker token in local configuration.
- The CLI starts the daemon after an explicit start command; it spawns the package entrypoint as a detached process.
- The daemon checks for updates periodically; the updater installs a newer release of this same package from npm.
- The worker sends its token to its configured API client and polls commands for its worker ID, matching its described remote job execution purpose.
Source & flagged code
5 flaggedPackage source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L2Package source invokes a package manager install command at runtime.
lib/updater.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to channel-worker@2.5.108.
See all versions of channel-worker for other recorded verdicts.
- Review the evidence and your use of channel-worker@2.5.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.