channel-worker@2.5.61

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Channel Manager worker daemon — runs on remote machines to execute video pipeline jobs

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The manifest has no install hook, and the inspected CLI and daemon behavior is tied to starting the worker. The runtime package installation is an update of channel-worker from the npm registry, with no inspected evidence of unrelated mutation, credential export, or malicious execution.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user invokes the CLI start command, which starts the daemon and its polling and update timers.

Impact

The inspected behavior supports the package's worker and update functions; no concrete malicious behavior was established.

Mechanism

The worker registers with its configured dashboard, polls for jobs and commands, and checks the npm registry for a newer release of channel-worker.

AI rationale

Network endpoints2

api.channel.tunasm.artregistry.npmjs.org/channel-worker/latest

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines only start and dev scripts; it has no install lifecycle hook.
The CLI starts the daemon after the user invokes start, and pairing uses a dashboard API URL.
The daemon registers the worker and starts job and command polling as part of its worker function.
The updater checks the npm registry for a newer channel-worker version and installs that package globally.
The background updater runs after daemon startup and on a timer; the source shows package self-updating rather than unrelated commands or data transfers.

Evidence against

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 475 KB of source, external domains: 127.0.0.1, affiliate.shopee.vn, api.channel.tunasm.art, down-vn.img.susercontent.com, registry.npmjs.org, shopee.vn, studio.youtube.com, www.facebook.com, www.youtube.com

Source & flagged code

6 flagged

bin/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = channel-worker@2.5.102 matchedIdentity = npm:Y2hhbm5lbC13b3JrZXI:2.5.102 similarity = 0.360 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

137// Spawn detached background process and exit L138: const { spawn } = require('child_process'); L139: const LOG_FILE = path.join(CONFIG_DIR, 'daemon.log');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L137

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L2

41const args = parseArgs(process.argv.slice(2)); const cmd = args._cmd || 'start'; if (cmd === 'pair') { // Pair with dashboard using one-time code const code = args.code; const apiUrl = args.api || DEFAULT_API_URL; const nstKey = args['nst-key'] || '';

Low

Ai Review Evidence

The CLI starts the daemon after the user invokes start, and pairing uses a dashboard API URL.

bin/cli.jsView on unpkg · L41

lib/updater.jsView file

29console.log(`[updater] Installing ${PKG_NAME}@${version}...`); L30: execSync(`npm install -g ${PKG_NAME}@${version}`, { stdio: 'inherit' }); L31: console.log(`[updater] Installed ${PKG_NAME}@${version}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/updater.jsView on unpkg · L29

package.jsonView file

14"scripts": { "start": "node bin/cli.js start", "dev": "node bin/cli.js start --verbose" }, "dependencies": { "node-fetch": "^3.3.2", "playwright-cor

Low

Suspicious Lifecycle Evidence

The manifest defines only start and dev scripts; it has no install lifecycle hook.

package.jsonView on unpkg · L14

Findings

1 Critical2 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/cli.js

HighChild Processbin/cli.js

HighRuntime Package Installlib/updater.js

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/cli.js

Affected versions and remediation

This report applies to channel-worker@2.5.61.

See all versions of channel-worker for other recorded verdicts.

Review the evidence and your use of channel-worker@2.5.61 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 17:49:35.485Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.