registry / channel-worker / 2.5.57

channel-worker@2.5.57

⚠ Under review

Channel Manager worker daemon — runs on remote machines to execute video pipeline jobs

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 470 KB of source, external domains: 127.0.0.1, affiliate.shopee.vn, api.channel.tunasm.art, down-vn.img.susercontent.com, registry.npmjs.org, shopee.vn, studio.youtube.com, www.facebook.com, www.youtube.com

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L2

5const os = require('os');

7const CONFIG_DIR = path.join(os.homedir(), '.channel-worker');

8const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

9const DEFAULT_API_URL = 'https://api.channel.tunasm.art';

10const DEFAULT_EXT_PATH = process.platform === 'win32'

11 ? 'C:\\agents\\channel-manager-ext'

12 : path.join(os.homedir(), 'channel-manager-ext');

14function parseArgs(args) {

15 const result = {};

16 for (let i = 0; i < args.length; i++) {

17 if (args[i].startsWith('--')) {

18 const key = args[i].slice(2);

19 const val = args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : true;

20 result[key] = val;

21 if (val !== true) i++;

22 } else if (!result._cmd) {

Lines 117-157javascript

117 nst_api_key: args['nst-key'] || saved.nst_api_key || '',

118 extension_path: args.extension || saved.extension_path || DEFAULT_EXT_PATH,

119 worker_token: args.token || saved.worker_token || '',

lib/updater.jsView file

Lines 9-49javascript

11async function getLatestVersion() {

12 const res = await fetch(`https://registry.npmjs.org/${PKG_NAME}/latest`);

lib/command-poller.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = channel-worker@2.5.35 matchedIdentity = npm:Y2hhbm5lbC13b3JrZXI:2.5.35 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/command-poller.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code