channel-worker@2.5.56

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Channel Manager worker daemon — runs on remote machines to execute video pipeline jobs

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Lifecycle hooks are absent, and the daemon, browser jobs, and npm self-update start only after an explicit CLI command with a worker token. Those behaviors match the stated channel-worker product and do not show a concrete hidden attack.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs channel-worker start or the update command after pairing.

Impact

The host runs the operator's channel worker and can replace its own global install with a newer published version. No unsolicited credential harvest or foreign agent-config write was found.

Mechanism

The CLI detaches a local daemon that heartbeats and polls the configured API, then may install a newer release of this same package from the npm registry.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes only start and dev scripts and has no preinstall, install, or postinstall hook.
The start command loads a local config and exits unless a worker token is already present.
The updater queries the public npm registry for this same package name and installs a newer global release only after the user-started daemon is running.

Evidence against

A running daemon checks for a newer channel-worker release every five minutes and can npm-install it globally, then restart.
After an explicit pair or init, the process polls the configured dashboard and drives browser profile jobs.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 448 KB of source, external domains: 127.0.0.1, affiliate.shopee.vn, api.channel.tunasm.art, down-vn.img.susercontent.com, registry.npmjs.org, shopee.vn, studio.youtube.com, www.facebook.com, www.youtube.com

Source & flagged code

5 flagged

bin/cli.jsView file

137// Spawn detached background process and exit L138: const { spawn } = require('child_process'); L139: const LOG_FILE = path.join(CONFIG_DIR, 'daemon.log');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L137

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L2

110} else if (cmd === 'start') { // Merge CLI args over saved config const saved = loadConfig(); const config = { worker_id: args.id || saved.worker_id || `worker-${os.hostn

Low

Ai Review Evidence

The start command loads a local config and exits unless a worker token is already present.

bin/cli.jsView on unpkg · L110

lib/updater.jsView file

Findings

3 High3 Medium6 Low

HighChild Processbin/cli.js

HighShell

HighRuntime Package Installlib/updater.js

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/cli.js

Affected versions and remediation

This report applies to channel-worker@2.5.56.

See all versions of channel-worker for other recorded verdicts.

Review the evidence and your use of channel-worker@2.5.56 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 23:13:09.025Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.