registry / clipp-cli / 0.1.0

clipp-cli@0.1.0

clipp any video from YouTube, X, Instagram, Threads & 1800+ sites — right from your terminal. paste. clipp. done.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 54.8 KB of source, external domains: github.com, x.com, youtu.be, youtube.com

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 688-728javascript

688 await fs2.utimes(local, /* @__PURE__ */ new Date(), /* @__PURE__ */ new Date()).catch(() => {

689 });

690 }

691 return local;

692 }

693 onStatus("first run: fetching yt-dlp\u2026");

694 await fs2.mkdir(CLIPP_DIR, { recursive: true });

695 const url = `${RELEASE_BASE}/${ytDlpAssetName()}`;

696 const response = await fetch(url, { signal });

697 if (!response.ok || !response.body) {

698 throw new Error(`Could not download yt-dlp (${response.status}). Check your connection and try again.`);

699 }

700 const tmp = `${local}.download`;

701 await pipeline(Readable.fromWeb(response.body), createWriteStream(tmp), { signal });

702 await fs2.chmod(tmp, 493);

703 await fs2.rename(tmp, local);

704 return local;

705}

706async function findFfmpeg() {

707 if (await commandWorks("ffmpeg", ["-version"])) return void 0;

708 try {

709 const mod = await import("ffmpeg-static");

710 const ffmpegPath = mod.default ?? mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L708

711 if (ffmpegPath && await commandWorks(ffmpegPath, ["-version"])) return ffmpegPath;

712 } catch {

713 }

714 return void 0;

715}

716async function probe(ytdlp, url, signal) {

717 const stdout = await new Promise((resolve, reject) => {

718 const child = spawn(ytdlp, ["-J", "--no-playlist", "--no-warnings", url], { signal });

719 let out = "";

720 let stderr = "";

721 child.stdout.on("data", (chunk) => out += chunk);

722 child.stderr.on("data", (chunk) => stderr += chunk);

723 child.on("error", reject);

724 child.on("close", (code) => {

725 if (code !== 0) {

726 reject(new Error(cleanYtDlpError(stderr) || `yt-dlp exited with code ${code}`));

727 } else {

728 resolve(out);

Source & flagged code

1 flagged · loading source

dist/cli.jsView file

708package = clipp-cli; repositoryIdentity = clipp; dependency = ffmpeg-static L708: try { L709: const mod = await import("ffmpeg-static"); L710: const ffmpegPath = mod.default ?? mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L708

Findings

1 High2 Medium4 Low

HighCopied Package Dependency Bridgedist/cli.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 688-728javascript

688 await fs2.utimes(local, /* @__PURE__ */ new Date(), /* @__PURE__ */ new Date()).catch(() => {

689 });

690 }

691 return local;

692 }

693 onStatus("first run: fetching yt-dlp\u2026");

694 await fs2.mkdir(CLIPP_DIR, { recursive: true });

695 const url = `${RELEASE_BASE}/${ytDlpAssetName()}`;

696 const response = await fetch(url, { signal });

697 if (!response.ok || !response.body) {

698 throw new Error(`Could not download yt-dlp (${response.status}). Check your connection and try again.`);

699 }

700 const tmp = `${local}.download`;

701 await pipeline(Readable.fromWeb(response.body), createWriteStream(tmp), { signal });

702 await fs2.chmod(tmp, 493);

703 await fs2.rename(tmp, local);

704 return local;

705}

706async function findFfmpeg() {

707 if (await commandWorks("ffmpeg", ["-version"])) return void 0;

708 try {

709 const mod = await import("ffmpeg-static");

710 const ffmpegPath = mod.default ?? mod;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L708

711 if (ffmpegPath && await commandWorks(ffmpegPath, ["-version"])) return ffmpegPath;

712 } catch {

713 }

714 return void 0;

715}

716async function probe(ytdlp, url, signal) {

717 const stdout = await new Promise((resolve, reject) => {

718 const child = spawn(ytdlp, ["-J", "--no-playlist", "--no-warnings", url], { signal });

719 let out = "";

720 let stderr = "";

721 child.stdout.on("data", (chunk) => out += chunk);

722 child.stderr.on("data", (chunk) => stderr += chunk);

723 child.on("error", reject);

724 child.on("close", (code) => {

725 if (code !== 0) {

726 reject(new Error(cleanYtDlpError(stderr) || `yt-dlp exited with code ${code}`));

727 } else {

728 resolve(out);