registry / extract-youtube / 1.0.11

extract-youtube@1.0.11

Fast, no-browser serverless-optimized YouTube transcript extractor

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 1.10 MB of source, external domains: consent.youtube.com, github.com, proxy.example.com, rolldown.rs, stuk.github.io, www.w3.org, www.webshare.io, www.youtube.com

Source & flagged code

4 flagged

dist/index-CLlAnStL-BKslXZFs.mjsView file

Lines 1-2javascript

1function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function

Source & flagged code

4 flagged · loading source

dist/index-CLlAnStL-BKslXZFs.mjsView file

1patternName = generic_password severity = medium line = 1 matchedText = function...ML};

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index-CLlAnStL-BKslXZFs.mjsView on unpkg · L1

dist/archiver-web.es-3EQgnnex.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/archiver-web.es-3EQgnnex.jsView on unpkg · L1

dist/index-CLlAnStL-DDV_Pgc5.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = function...iew;

Medium

Secret Pattern

Hardcoded password in dist/index-CLlAnStL-DDV_Pgc5.js

dist/index-CLlAnStL-DDV_Pgc5.jsView on unpkg · L1

dist/index-CLlAnStL-BNm8mEFS.jsView file

2762patternName = generic_password severity = medium line = 2762 matchedText = password...d]",

Medium

Secret Pattern

Hardcoded password in dist/index-CLlAnStL-BNm8mEFS.js

dist/index-CLlAnStL-BNm8mEFS.jsView on unpkg · L2762

Findings

6 Medium7 Low

MediumSecret Patterndist/index-CLlAnStL-BKslXZFs.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index-CLlAnStL-DDV_Pgc5.js

MediumSecret Patterndist/index-CLlAnStL-BNm8mEFS.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/archiver-web.es-3EQgnnex.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/archiver-web.es-3EQgnnex.jsView file

Lines 1-2javascript

1var e=Object.create,t=Object.defineProperty,r=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,i=Object.getPrototypeOf,s=Object.prototype.hasOwnProperty,a=(a,o,h)=>(h=null!=a?e(i(a)):{},((e,i,a,o)=>{if(i&&"object"==typeof i||"function"==typeof i)for(var h,u=n(i),l=0,f=u.length;l<f;l++)h=u[l],s.call(e,h)||h===a||t(e,h,{get:(e=>i[e]).bind(null,h),enumerable:!(o=r(i,h))||o.enumerable});return e})(!o&&a&&a.__esModule?h:t(h,"default",{value:a,enumerable:!0}),a)),o=((e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports))((e,t)=>{!function(r){"object"==typeof e&&void 0!==t?t.exp ...

2//# sourceMappingURL=archiver-web.es-3EQgnnex.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/archiver-web.es-3EQgnnex.jsView on unpkg · L1

Long lines were clipped for display.

dist/index-CLlAnStL-DDV_Pgc5.jsView file

Lines 1-2javascript

1function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){if(Object.prototype.hasOwnProperty.call(e,"__esModule"))return e;var t=e.default;if("function"==typeof t){var n=function e(){var n=!1;try{n=this instanceof e}catch{}return n?Reflect.construct(t,arguments,this.constructor):t.apply(this,arguments)};n.prototype=t.prototype}else n={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.keys(e).forEach(function(t){var s=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,s.get?s:{enumerable:!0,get:function(){return ...

Medium

Secret Pattern

Hardcoded password in dist/index-CLlAnStL-DDV_Pgc5.js

dist/index-CLlAnStL-DDV_Pgc5.jsView on unpkg · L1

2//# sourceMappingURL=index-CLlAnStL-DDV_Pgc5.js.map

Long lines were clipped for display.

dist/index-CLlAnStL-BNm8mEFS.jsView file

Lines 2742-2782javascript

2742 return t.getSiblings(e).every((A) => n(e, A) || !t.isTag(A) || t.getName(A) !== s);

2743 },

2744 "only-child": (e, { adapter: t, equals: n }) => t.getSiblings(e).every((s) => n(e, s) || !t.isTag(s))

2745};

2746function Is(e, t, n, s) {

2747 if (null === n) {

2748 if (e.length > s) throw new Error(`Pseudo-class :${t} requires an argument`);

2749 } else if (e.length === s) throw new Error(`Pseudo-class :${t} doesn't have any arguments`);

2750}

2751var ws = {

2752 "any-link": ":is(a, area, link)[href]",

2753 link: ":any-link:not(:visited)",

2754 disabled: ":is(\n :is(button, input, select, textarea, optgroup, option)[disabled],\n optgroup[disabled] > option,\n fieldset[disabled]:not(fieldset[disabled] legend:first-of-type *)\n )",

2755 enabled: ":not(:disabled)",

2756 checked: ":is(:is(input[type=radio], input[type=checkbox])[checked], option:selected)",

2757 required: ":is(input, select, textarea)[required]",

2758 optional: ":is(input, select, textarea):not([required])",

2759 selected: "option:is([selected], select:not([multiple]):not(:has(> option[selected])) > :first-of-type)",

2760 checkbox: "[type=checkbox]",

2761 file: "[type=file]",

2762 password: "[type=password]",

Medium

Secret Pattern

Hardcoded password in dist/index-CLlAnStL-BNm8mEFS.js

dist/index-CLlAnStL-BNm8mEFS.jsView on unpkg · L2762

2763 radio: "[type=radio]",

2764 reset: "[type=reset]",

2765 image: "[type=image]",

2766 submit: "[type=submit]",

2767 parent: ":not(:empty)",

2768 header: ":is(h1, h2, h3, h4, h5, h6)",

2769 button: ":is(button, input[type=button])",

2770 input: ":is(input, textarea, select, button)",

2771 text: "input:is(:not([type!='']), [type=text])"

2772};

2773var Bs = {};

2774function Es(e, t) {

2775 return e === Zn.falseFunc ? Zn.falseFunc : (n) => t.isTag(n) && e(n);

2776}

2777function xs(e, t) {

2778 const n = t.getSiblings(e);

2779 if (n.length <= 1) return [];

2780 const s = n.indexOf(e);

2781 return s < 0 || s === n.length - 1 ? [] : n.slice(s + 1).filter(t.isTag);

2782}