registry / iobroker.blink / 0.0.29

iobroker.blink@0.0.29

adapter for amazon blink system and ioBroker

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malware or exfiltration was found. The notable risk is runtime creation of an enabled ioBroker JavaScript helper script that can run shell commands and start local HTTP/HLS services for package-aligned camera functionality.

Static reason

One or more suspicious static signals were detected.

Trigger

ioBroker adapter runtime onReady and user/live-view actions

Impact

Warn-level extension/persistence risk inside ioBroker; no evidence of credential theft or attacker-controlled remote code execution.

Mechanism

runtime ioBroker script creation plus Blink API polling, media download, and ffmpeg streaming

Attack narrative

At adapter startup, main.js reads lib/blink-video-url-server.json and installs an enabled ioBroker JavaScript script object. That script exposes local camera/video endpoints and can use exec to query ioBroker config and start package helper scripts. The behavior is broad and persistent within ioBroker, but source inspection shows it is tied to Blink camera streaming and local media serving rather than credential harvesting, external exfiltration, AI-agent control hijack, or install-time compromise.

Rationale

The package has real privileged runtime behavior, including auto-created ioBroker script code and child_process usage, so a warn is appropriate. The observed network and file activity is package-aligned Blink camera login, polling, snapshot/video storage, and local streaming, with no concrete malicious endpoint or payload.

Evidence

package.jsonmain.jslib/blink-api.jslib/blink-video-url-server.jsonlib/immi-live-hls.jslib/mjpeg-server.jslib/blink-liveview-iobroker.js/tmp/blink_session_cache/tmp/blink_debug.log/tmp/blink_liveview_session.json/tmp/blink_hlsconfigured snapshotDir

Network endpoints5

api.oauth.blink.comrest-prod.immedia-semi.comdynamic https://${session.apiHost}local http://<host>:8085local http://<host>:8099

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

main.js creates/updates enabled ioBroker javascript object script.js.common.blink-video-url-server at runtime from lib/blink-video-url-server.json.
lib/blink-video-url-server.json embedded script uses exec fallback to run iobroker object get and launches package helper scripts for LiveView/HLS.
lib/immi-live-hls.js and main.js spawn ffmpeg for camera live/HLS streams.
lib/blink-api.js caches Blink sessions under /tmp/blink_session_cache and writes downloaded media/snapshots to configured paths.

Evidence against

package.json has no npm lifecycle hooks or bin entrypoint; main is the ioBroker adapter main.js.
Network activity is aligned with Blink camera functionality: api.oauth.blink.com, rest-prod.immedia-semi.com, and session apiHost.
Debug logging redacts password, PIN, auth_token, access_token, refresh_token, and token fields.
Local HTTP/MJPEG/HLS servers serve camera streams/files with path checks and token protection for MJPEG.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 232 KB of source, external domains: 127.0.0.1, api.oauth.blink.com

Source & flagged code

4 flagged

lib/blink-video-url-server.jsonView file

Lines 1-16json

2 "type": "script",

3 "common": {

4 "name": "blink-video-url-server",

5 "enabled": true,

6 "engine": "system.adapter.javascript.0",

7 "engineType": "Javascript/js",

8 "source": "/* global log, exec, getObject, getState, setState, existsState, existsObject, $, onStop */\n/* eslint-disable no-empty, no-useless-escape, @typescript-eslint/no-unused-vars */\n// ============================================================\n// Blink Multi-Camera Server + Grid + History + LiveView/HLS\n// http://<host>:8085/grid → All cameras in the grid including history and live\n// http://<host>:8085/cameras → camera JSON\n// http://<host>:8085/live/start?camera=ID → Start LiveView\n// http://<host>:8085/live/stop → Stop LiveVi ...

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

9 "debug": false,

10 "verbose": false

11 },

12 "native": {

13 "scriptVersion": "0.0.24"

14 }

15}

Long lines were clipped for display.

main.jsView file

Lines 1-25javascript

1'use strict';

2/*

3 * Created with @iobroker/create-adapter v3.1.2

4 */

6const utils = require('@iobroker/adapter-core');

7const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/immi-live-hls.js#virtual:normalized:round1View file

9const path = require('node:path'); L10: const tls = require('node:tls'); L11: const http = require('node:http'); L12: const { spawn, spawnSync } = require('node:child_process'); L13: L14: const SESSION_JSON = process.argv[2] || process.env.IMMI_SESSION_JSON || '/tmp/blink_liveview_session.json'; L15: const SERIAL = process.env.IMMI_SERIAL || process.env.BLINK_DEVICE_SERIAL || 'G8T1940153360515';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Source & flagged code

4 flagged · loading source

lib/blink-video-url-server.jsonView file

8patternName = generic_password severity = medium line = 8 matchedText = "source"...\n",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

main.jsView file

1694async startHlsProxy(devId, live) { L1695: const { spawn } = require('node:child_process'); L1696: await this.startHlsServer();

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1694

5L6: const utils = require('@iobroker/adapter-core'); L7: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

main.jsView on unpkg · L5

lib/immi-live-hls.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Findings

2 High3 Medium4 Low

HighChild Processmain.js

HighSame File Env Network Executionlib/immi-live-hls.js#virtual:normalized:round1

MediumSecret Patternlib/blink-video-url-server.json

MediumDynamic Requiremain.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

lib/blink-video-url-server.jsonView file

Lines 1-16json

2 "type": "script",

3 "common": {

4 "name": "blink-video-url-server",

5 "enabled": true,

6 "engine": "system.adapter.javascript.0",

7 "engineType": "Javascript/js",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

9 "debug": false,

10 "verbose": false

11 },

12 "native": {

13 "scriptVersion": "0.0.24"

14 }

15}

Long lines were clipped for display.

main.jsView file

Lines 1-25javascript

1'use strict';

2/*

3 * Created with @iobroker/create-adapter v3.1.2

4 */

6const utils = require('@iobroker/adapter-core');

7const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/immi-live-hls.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Lines 1674-1714javascript

1674 if (Object.prototype.hasOwnProperty.call(patch, 'active')) {

1675 await this.setStateAsync(`${base}.active`, !!patch.active, true);

1676 }

1677 if (Object.prototype.hasOwnProperty.call(patch, 'url')) {

1678 await this.setStateAsync(`${base}.url`, String(patch.url || ''), true);

1679 }

1680 if (Object.prototype.hasOwnProperty.call(patch, 'expires_at')) {

1681 await this.setStateAsync(`${base}.expires_at`, String(patch.expires_at || ''), true);

1682 }

1683 if (Object.prototype.hasOwnProperty.call(patch, 'last_error')) {

1684 await this.setStateAsync(`${base}.last_error`, String(patch.last_error || ''), true);

1685 }

1686 if (Object.prototype.hasOwnProperty.call(patch, 'session_id')) {

1687 await this.setStateAsync(`${base}.session_id`, String(patch.session_id || ''), true);

1688 }

1689 if (Object.prototype.hasOwnProperty.call(patch, 'backend')) {

1690 await this.setStateAsync(`${base}.backend`, String(patch.backend || ''), true);

1691 }

1692 }

1693

1694 async startHlsProxy(devId, live) {

1695 const { spawn } = require('node:child_process');

1696 await this.startHlsServer();

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1694

1697 const outDir = path.join(this.cfg.snapshotDir, 'live', devId);

1698 fs.mkdirSync(outDir, { recursive: true });

1699 const playlist = path.join(outDir, 'index.m3u8');

1700

1701 try {

1702 for (const f of fs.readdirSync(outDir)) {

1703 fs.unlinkSync(path.join(outDir, f));

1704 }

1705 } catch {

1706 // ignore

1707 }

1708

1709 const args = [

1710 '-rtsp_transport',

1711 'tcp',

1712 '-i',

1713 String(live.sourceUrl || ''),

1714 '-an',