registry / Telemetry / free-short-video

free-short-video

Free AI short-video generator — run the full free-short-video service locally with one command. Text-to-video, image generation, Edge-TTS narration, subtitles, and compositing, all free. Official site: https://video.lichuanyang.top

This report shows the evidence for free-short-video@7.2.4. 0 of 31 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 12h ago · by lpm-firewall-ai

The CLI’s setup and local server launch fit the package’s purpose, but the web UI automatically sends analytics events and browser exception descriptions to Google Analytics. The local opt-out does not make this undisclosed telemetry clean.

Static reason

One or more suspicious static signals were detected.

Trigger

When the web UI loads, its entry code initializes analytics and error listeners.

Impact

Browser events and exception details may be disclosed to Google Analytics without an explicit opt-in.

Mechanism

It loads the Google Analytics script and sends events and browser exception descriptions. A localStorage opt-out is provided.

AI rationale

Evidence

static/assets/index-CZW4JQ_F.js

Network endpoints1

www.googletagmanager.com/gtag/js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The web UI automatically initializes Google Analytics when it mounts.
The UI sends analytics events and browser exception descriptions to Google Analytics; a local opt-out is available.
The launcher installs the listed Python requirements and starts the local service when invoked.

Evidence against

The launcher’s Python dependency installation and local service startup match the package’s stated purpose.
The reviewed sources show no automatic collection or transmission of API keys or unrelated local files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 1.66 MB of source, external domains: api.deepseek.com, developer.amd.com.cn, github.com, platform.agnes-ai.cn, platform.agnes-ai.com, video.lichuanyang.top, vuejs.org, www.googletagmanager.com, www.python.org, www.w3.org

Source & flagged code

5 flagged

bin/cli.jsView file

16L17: const { spawn, execSync } = require('child_process'); L18: const fs = require('fs'); ... L21: L22: const PKG_ROOT = path.resolve(__dirname, '..'); L23: ... L25: const link = (url, text) => L26: process.stdout.isTTY ? `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\` : text; L27: ... L37: FSV_LOGO.forEach((l) => console.log(l)); L38: process.stdout.write('\x1b[0m'); L39: } else {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L16

250} else { console.log('[2/3] Installing Python dependencies (first run only)...'); run(`"${venvPip}" install -q --upgrade-strategy only-if-needed -r "${path.

Medium

Ai Review Evidence

The launcher installs the listed Python requirements and starts the local service when invoked.

bin/cli.jsView on unpkg · L250

server.pyView file

•path = server.py kind = build_helper sizeBytes = 12036 magicHex = [redacted]

Findings

1 High7 Medium4 Low

HighSandbox Evasion Gated Capabilitybin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperserver.py

MediumStructural Risk Force Deep Review

MediumAi Review Evidencebin/cli.js

MediumAi Review Evidencestatic/assets/index-CZW4JQ_F.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to free-short-video@7.2.4.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of free-short-video@7.2.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 11:32:55.750Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

31 known versions

7.2.4latestshownSuspiciousTelemetryWarnPublishedNov 4, 2026, 11:27 AM 7.2.2Clean—AllowPublishedOct 23, 2026, 1:26 AM 7.2.0Clean—AllowPublishedOct 20, 2026, 1:16 PM 7.1.1Clean—AllowPublishedOct 15, 2026, 5:29 AM

registry / Telemetry / free-short-video

free-short-video

This report shows the evidence for free-short-video@7.2.4. 0 of 31 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 12h ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

When the web UI loads, its entry code initializes analytics and error listeners.

Impact

Browser events and exception details may be disclosed to Google Analytics without an explicit opt-in.

Mechanism

It loads the Google Analytics script and sends events and browser exception descriptions. A localStorage opt-out is provided.

AI rationale

Evidence

static/assets/index-CZW4JQ_F.js

Network endpoints1

www.googletagmanager.com/gtag/js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The web UI automatically initializes Google Analytics when it mounts.
The UI sends analytics events and browser exception descriptions to Google Analytics; a local opt-out is available.
The launcher installs the listed Python requirements and starts the local service when invoked.

Evidence against

The launcher’s Python dependency installation and local service startup match the package’s stated purpose.
The reviewed sources show no automatic collection or transmission of API keys or unrelated local files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

bin/cli.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L16

250} else { console.log('[2/3] Installing Python dependencies (first run only)...'); run(`"${venvPip}" install -q --upgrade-strategy only-if-needed -r "${path.

Medium

Ai Review Evidence

The launcher installs the listed Python requirements and starts the local service when invoked.

bin/cli.jsView on unpkg · L250

server.pyView file

•path = server.py kind = build_helper sizeBytes = 12036 magicHex = [redacted]

Findings

1 High7 Medium4 Low

HighSandbox Evasion Gated Capabilitybin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperserver.py

MediumStructural Risk Force Deep Review

MediumAi Review Evidencebin/cli.js

MediumAi Review Evidencestatic/assets/index-CZW4JQ_F.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to free-short-video@7.2.4.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of free-short-video@7.2.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 11:32:55.750Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

31 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Runtime surface

Behavioral surface