registry / itsmeeaizat-bailey / 1.0.0

itsmeeaizat-bailey@1.0.0

AI Security Review

scanned 26d ago · by lpm-firewall-ai

An application that passes an attacker-controlled video filename to the exported thumbnail helper can invoke shell metacharacters. No automatic install-time attack surface was found.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer calls generateThumbnail with mediaType set to video and an untrusted file path.

Impact

Arbitrary commands may run with the consuming application's privileges.

Mechanism

Unquoted path interpolation into child_process.exec.

AI rationale

The package contains a concrete, externally reachable command-injection vulnerability in video thumbnail processing. It has no lifecycle hook or demonstrated autonomous malicious behavior, so it should be warned rather than blocked as malware.

Evidence

lib/Utils/messages-media.js

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

Video thumbnail generation interpolates its path argument into an unquoted shell command.
The vulnerable thumbnail function is exported and accepts a caller-supplied file argument.
The manifest includes an obfuscation development dependency, increasing review concern although no obfuscated shipped artifact was identified.

itsmeeaizat-bailey@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code