registry / Remote code execution / channel-worker / 2.5.69

channel-worker@2.5.69

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Channel Manager worker daemon — runs on remote machines to execute video pipeline jobs

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a real, high-impact remote update and browser-control capability with no visible artifact verification. It lacks install-time execution and direct theft behavior, so the source supports a warning rather than a malicious publish block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user pairs and starts the worker daemon.

Impact

A compromised or malicious configured service can replace extension code and control configured browser profiles.

Mechanism

Remote command polling and unsigned automatic archive and package updates.

AI rationale

Evidence

lib/daemon.jslib/extension-updater.jslib/updater.jslib/command-poller.jslib/api-client.js~/.channel-worker/config.json~/channel-manager-ext

Network endpoints2

api.channel.tunasm.artregistry.npmjs.org/channel-worker/latest

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

The daemon automatically checks for and applies extension updates at startup and every five minutes.
The extension updater downloads an archive, extracts it, deletes the existing extension directory, and copies the new files without an integrity check.
The running worker polls a remote dashboard for commands that control browser profiles, files, uploads, and extension updates.
A background updater installs the latest package globally and restarts the daemon.

Evidence against

The manifest has no preinstall, install, or postinstall lifecycle hook.
The daemon is activated through explicit CLI pairing and start commands.
No direct credential harvesting or secret exfiltration code was found in the inspected paths.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

5 flagged

bin/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = channel-worker@2.5.35 matchedIdentity = npm:Y2hhbm5lbC13b3JrZXI:2.5.35 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

145// Spawn detached background process and exit L146: const { spawn } = require('child_process'); L147: const LOG_FILE = path.join(CONFIG_DIR, 'daemon.log');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L145

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L2

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltabin/cli.js

HighChild Processbin/cli.js

HighRuntime Package Installlib/updater.js

HighSemantic Analysis Limitedlib/daemon.js#virtual:normalized:round1

MediumDynamic Requirebin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to channel-worker@2.5.69.

See all versions of channel-worker for other recorded verdicts.

Review the evidence and your use of channel-worker@2.5.69 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 19:02:29.407Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.