registry / iobroker.blink / 0.0.32

iobroker.blink@0.0.32

adapter for amazon blink system and ioBroker

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 240 KB of source, external domains: 127.0.0.1, api.oauth.blink.com

Source & flagged code

5 flagged

lib/blink-video-url-server.jsonView file

Lines 1-16json

2 "type": "script",

3 "common": {

4 "name": "blink-video-url-server",

5 "enabled": true,

6 "engine": "system.adapter.javascript.0",

7 "engineType": "Javascript/js",

8 "source": "/* global log, exec, getObject, getState, setState, existsState, existsObject, $, onStop */\n/* eslint-disable no-empty, no-useless-escape, @typescript-eslint/no-unused-vars */\n// ============================================================\n// Blink Multi-Camera Server + Grid + History + LiveView/HLS\n// http://<host>:8085/grid → All cameras in the grid including history and live\n// http://<host>:8085/cameras → camera JSON\n// http://<host>:8085/live/start?camera=ID → Start LiveView\n// http://<host>:8085/live/stop → Stop LiveVi ...

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

9 "debug": false,

10 "verbose": false

11 },

12 "native": {

13 "scriptVersion": "0.0.24"

14 }

15}

Long lines were clipped for display.

main.jsView file

Lines 1-25javascript

1'use strict';

2/*

3 * Created with @iobroker/create-adapter v3.1.2

4 */

6const utils = require('@iobroker/adapter-core');

7const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/immi-live-hls.js#virtual:normalized:round1View file

9const path = require('node:path'); L10: const tls = require('node:tls'); L11: const http = require('node:http'); L12: const { spawn, spawnSync } = require('node:child_process'); L13: L14: const SESSION_JSON = process.argv[2] || process.env.IMMI_SESSION_JSON || '/tmp/blink_liveview_session.json'; L15: const SERIAL = process.env.IMMI_SERIAL || process.env.BLINK_DEVICE_SERIAL || 'G8T1940153360515';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Source & flagged code

5 flagged · loading source

lib/blink-video-url-server.jsonView file

8patternName = generic_password severity = medium line = 8 matchedText = "source"...\n",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

main.jsView file

1719async startHlsProxy(devId, live) { L1720: const { spawn } = require('node:child_process'); L1721: await this.startHlsServer();

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1719

•matchType = previous_version_dangerous_delta matchedPackage = iobroker.blink@0.0.29 matchedIdentity = npm:aW9icm9rZXIuYmxpbms:0.0.29 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

main.jsView on unpkg

5L6: const utils = require('@iobroker/adapter-core'); L7: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

main.jsView on unpkg · L5

lib/immi-live-hls.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Findings

3 High3 Medium4 Low

HighChild Processmain.js

HighSame File Env Network Executionlib/immi-live-hls.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltamain.js

MediumSecret Patternlib/blink-video-url-server.json

MediumDynamic Requiremain.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

lib/blink-video-url-server.jsonView file

Lines 1-16json

2 "type": "script",

3 "common": {

4 "name": "blink-video-url-server",

5 "enabled": true,

6 "engine": "system.adapter.javascript.0",

7 "engineType": "Javascript/js",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

9 "debug": false,

10 "verbose": false

11 },

12 "native": {

13 "scriptVersion": "0.0.24"

14 }

15}

Long lines were clipped for display.

main.jsView file

Lines 1-25javascript

1'use strict';

2/*

3 * Created with @iobroker/create-adapter v3.1.2

4 */

6const utils = require('@iobroker/adapter-core');

7const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/immi-live-hls.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Lines 1699-1739javascript

1699 if (Object.prototype.hasOwnProperty.call(patch, 'active')) {

1700 await this.setStateAsync(`${base}.active`, !!patch.active, true);

1701 }

1702 if (Object.prototype.hasOwnProperty.call(patch, 'url')) {

1703 await this.setStateAsync(`${base}.url`, String(patch.url || ''), true);

1704 }

1705 if (Object.prototype.hasOwnProperty.call(patch, 'expires_at')) {

1706 await this.setStateAsync(`${base}.expires_at`, String(patch.expires_at || ''), true);

1707 }

1708 if (Object.prototype.hasOwnProperty.call(patch, 'last_error')) {

1709 await this.setStateAsync(`${base}.last_error`, String(patch.last_error || ''), true);

1710 }

1711 if (Object.prototype.hasOwnProperty.call(patch, 'session_id')) {

1712 await this.setStateAsync(`${base}.session_id`, String(patch.session_id || ''), true);

1713 }

1714 if (Object.prototype.hasOwnProperty.call(patch, 'backend')) {

1715 await this.setStateAsync(`${base}.backend`, String(patch.backend || ''), true);

1716 }

1717 }

1718

1719 async startHlsProxy(devId, live) {

1720 const { spawn } = require('node:child_process');

1721 await this.startHlsServer();

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1719

1722 const outDir = path.join(this.cfg.snapshotDir, 'live', devId);

1723 fs.mkdirSync(outDir, { recursive: true });

1724 const playlist = path.join(outDir, 'index.m3u8');

1725

1726 try {

1727 for (const f of fs.readdirSync(outDir)) {

1728 fs.unlinkSync(path.join(outDir, f));

1729 }

1730 } catch {

1731 // ignore

1732 }

1733

1734 const args = [

1735 '-rtsp_transport',

1736 'tcp',

1737 '-i',

1738 String(live.sourceUrl || ''),

1739 '-an',