Loading npm security reports…

koubo-clip: Suspicious npm security report (Warn) | LPM Firewall

registry / koubo-clip / 0.0.10

koubo-clip@0.0.10

⚠ Under review

Agent-driven local talking-head video cleanup and enrichment CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 1.97 MB of source, external domains: a.basemaps.cartocdn.com, api.cloudflare.com, api.heygen.com, api.iconify.design, api.lordicon.com, api.minimaxi.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, example.invalid, fonts.googleapis.com, fonts.gstatic.com, freesound.org, generativelanguage.googleapis.com, gsap.com, icon-sets.iconify.design, json-schema.org, koubo-clip.dev, lordicon.com, pixabay.com, server.arcgisonline.com, www.w3.org

Source & flagged code

8 flagged

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/*

3 * make-composition.cjs — compile plan.json → index.html (CINEMATIC MODE).

4 *

5 * DNA path (canonical): plan.dna names a dna/<name>.json → modes/cinematic/engine.html

6 * is compiled with scene-resolved tokens (lib-dna.cjs): scene-sampled accent, light-

7 * direction contact shadow, depth-match blur, hero three-act orchestration with

8 * RMS-coupled amplitude. plan.template="cinematic-cream" maps to dna "cream".

9 *

10 * Legacy path: plan.template naming an archived template dir still compiles 1:1

11 * (memory-wall / champion / portrait-header in modes/cinematic/_archive are NOT

12 * auto-discovered — restore them to modes/cinematic/ to use).

13 *

14 * node make-composition.cjs <project-dir>

15 */

16const path = require("path");

17const fs = require("fs");

18const cp = require("child_process");

19const dnaLib = require("./lib-dna.cjs");

High

Child Process

Package source references child process execution.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView on unpkg · L17

21const SKILL_ROOT = path.resolve(__dirname, "..");

22const TEMPLATES = path.join(SKILL_ROOT, "modes", "cinematic");

24// Source clip duration (seconds) via ffprobe. The COMPOSITION/background length must

25// follow the SOURCE, not the last caption — see the Bug-1 note in main().

26function sourceDurationSec(project) {

27 let cands = ["source.mp4"];

28 try {

29 cands = cands.concat(

30 fs

31 .readdirSync(project)

32 .filter(

33 (f) =>

34 /\.(mp4|mov|webm|mkv|m4v)$/i.test(f) &&

35 !/^(final|bg_plus_caps|fg_caps|rail|index)/.test(f),

36 ),

37 );

packages/cli/vendor/hyperframes/registry/examples/vscode-theme-visualizer/scripts/build-compositions.mjsView file

Lines 1-39javascript

1import fs from "node:fs";

2import path from "node:path";

3import { fileURLToPath } from "node:url";

5const

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/build-fonts-css.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/*

3 * build-fonts-css.cjs — bundle the template fonts into ONE self-contained

4 * fonts.css with base64 data-URI @font-face (no sub-resources, no CDN, no

5 * system-font dependency). This is what makes Standard/Cinematic renders

6 * deterministic on ANY machine: hyperframes' renderer only auto-supplies its

7 * ~18 CANONICAL_FONTS; every other family falls back to a generic font unless

8 * the HTML ships a local @font-face. (hyperframes' own font linter says exactly

packages/cli/src/project.tsView file

Lines 5802-5842typescript

5802 return parseEditPlan(readProjectJson(projectPath, projectArtifacts.editPlan, "edit plan"), manifest);

5803 } catch (error) {

5804 if (error instanceof Error && error.message.includes("asset_usage_plan"

packages/cli/src/music/providers/minimax.tsView file

Lines 4-44typescript

5export type MusicProviderResult = {

6 provider: string;

7 model?: string;

8 prompt?:

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView file

•path = [redacted]-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 25300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView on unpkg

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View file

•path = [redacted]-[redacted]-latin-600-normal.woff2 kind = high_entropy_blob sizeBytes = 24452 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View on unpkg

Source & flagged code

8 flagged

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/*

3 * make-composition.cjs — compile plan.json → index.html (CINEMATIC MODE).

4 *

5 * DNA path (canonical): plan.dna names a dna/<name>.json → modes/cinematic/engine.html

6 * is compiled with scene-resolved tokens (lib-dna.cjs): scene-sampled accent, light-

7 * direction contact shadow, depth-match blur, hero three-act orchestration with

8 * RMS-coupled amplitude. plan.template="cinematic-cream" maps to dna "cream".

9 *

10 * Legacy path: plan.template naming an archived template dir still compiles 1:1

11 * (memory-wall / champion / portrait-header in modes/cinematic/_archive are NOT

12 * auto-discovered — restore them to modes/cinematic/ to use).

13 *

14 * node make-composition.cjs <project-dir>

15 */

16const path = require("path");

17const fs = require("fs");

18const cp = require("child_process");

19const dnaLib = require("./lib-dna.cjs");

High

Child Process

Package source references child process execution.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView on unpkg · L17

21const SKILL_ROOT = path.resolve(__dirname, "..");

22const TEMPLATES = path.join(SKILL_ROOT, "modes", "cinematic");

24// Source clip duration (seconds) via ffprobe. The COMPOSITION/background length must

25// follow the SOURCE, not the last caption — see the Bug-1 note in main().

26function sourceDurationSec(project) {

27 let cands = ["source.mp4"];

28 try {

29 cands = cands.concat(

30 fs

31 .readdirSync(project)

32 .filter(

33 (f) =>

34 /\.(mp4|mov|webm|mkv|m4v)$/i.test(f) &&

35 !/^(final|bg_plus_caps|fg_caps|rail|index)/.test(f),

36 ),

37 );

packages/cli/vendor/hyperframes/registry/examples/vscode-theme-visualizer/scripts/build-compositions.mjsView file

Lines 1-39javascript

1import fs from "node:fs";

2import path from "node:path";

3import { fileURLToPath } from "node:url";

5const

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/build-fonts-css.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/*

3 * build-fonts-css.cjs — bundle the template fonts into ONE self-contained

4 * fonts.css with base64 data-URI @font-face (no sub-resources, no CDN, no

5 * system-font dependency). This is what makes Standard/Cinematic renders

6 * deterministic on ANY machine: hyperframes' renderer only auto-supplies its

7 * ~18 CANONICAL_FONTS; every other family falls back to a generic font unless

8 * the HTML ships a local @font-face. (hyperframes' own font linter says exactly

packages/cli/src/project.tsView file

Lines 5802-5842typescript

5802 return parseEditPlan(readProjectJson(projectPath, projectArtifacts.editPlan, "edit plan"), manifest);

5803 } catch (error) {

5804 if (error instanceof Error && error.message.includes("asset_usage_plan"

packages/cli/src/music/providers/minimax.tsView file

Lines 4-44typescript

5export type MusicProviderResult = {

6 provider: string;

7 model?: string;

8 prompt?:

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView file

•path = [redacted]-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 25300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView on unpkg

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View file

•path = [redacted]-[redacted]-latin-600-normal.woff2 kind = high_entropy_blob sizeBytes = 24452 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code