Loading npm security reports…

koubo-clip@0.0.8: Clean npm security report (Allow) | LPM Firewall

registry / koubo-clip / 0.0.8

koubo-clip@0.0.8

Agent-driven local talking-head video cleanup and enrichment CLI.

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 1.96 MB of source, external domains: a.basemaps.cartocdn.com, api.cloudflare.com, api.heygen.com, api.iconify.design, api.lordicon.com, api.minimaxi.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, example.invalid, fonts.googleapis.com, fonts.gstatic.com, freesound.org, generativelanguage.googleapis.com, gsap.com, icon-sets.iconify.design, json-schema.org, koubo-clip.dev, lordicon.com, pixabay.com, server.arcgisonline.com, www.w3.org

Source & flagged code

7 flagged

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/*

3 * make-composition.cjs — compile plan.json → index.html (CINEMATIC MODE).

4 *

5 * DNA path (canonical): plan.dna names a dna/<name>.json → modes/cinematic/engine.html

6 * is compiled with scene-resolved tokens (lib-dna.cjs): scene-sampled accent, light-

7 * direction contact shadow, depth-match blur, hero three-act orchestration with

8 * RMS-coupled amplitude. plan.template="cinematic-cream" maps to dna "cream".

9 *

10 * Legacy path: plan.template naming an archived template dir still compiles 1:1

11 * (memory-wall / champion / portrait-header in modes/cinematic/_archive are NOT

12 * auto-discovered — restore them to modes/cinematic/ to use).

13 *

14 * node make-composition.cjs <project-dir>

15 */

16const path = require("path");

17const fs = require("fs");

18const cp = require("child_process");

19const dnaLib = require("./lib-dna.cjs");

High

Child Process

Package source references child process execution.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView on unpkg · L17

21const SKILL_ROOT = path.resolve(__dirname, "..");

22const TEMPLATES = path.join(SKILL_ROOT, "modes", "cinematic");

24// Source clip duration (seconds) via ffprobe. The COMPOSITION/background length must

25// follow the SOURCE, not the last caption — see the Bug-1 note in main().

26function sourceDurationSec(project) {

27 let cands = ["source.mp4"];

28 try {

29 cands = cands.concat(

30 fs

31 .readdirSync(project)

32 .filter(

33 (f) =>

34 /\.(mp4|mov|webm|mkv|m4v)$/i.test(f) &&

35 !/^(final|bg_plus_caps|fg_caps|rail|index)/.test(f),

36 ),

37 );

packages/cli/vendor/hyperframes/registry/examples/vscode-theme-visualizer/scripts/build-compositions.mjsView file

Lines 1-39javascript

1import fs from "node:fs";

2import path from "node:path";

3import { fileURLToPath } from "node:url";

5const

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/build-fonts-css.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/*

3 * build-fonts-css.cjs — bundle the template fonts into ONE self-contained

4 * fonts.css with base64 data-URI @font-face (no sub-resources, no CDN, no

5 * system-font dependency). This is what makes Standard/Cinematic renders

6 * deterministic on ANY machine: hyperframes' renderer only auto-supplies its

7 * ~18 CANONICAL_FONTS; every other family falls back to a generic font unless

8 * the HTML ships a local @font-face. (hyperframes' own font linter says exactly

9 * this: "Use local @font-face declarations with captured .woff2 files.")

packages/cli/src/project.tsView file

Lines 5801-5841typescript

5801 return parseEditPlan(readProjectJson(projectPath, projectArtifacts.editPlan, "edit plan"), manifest);

5802 } catch (error) {

5803 if (error instanceof Error && error.message.includes("asset_usage_plan"

packages/cli/src/music/providers/minimax.tsView file

Lines 4-44typescript

5export type MusicProviderResult = {

6 provider: string;

7 model?: string;

8 prompt?:

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView file

•path = [redacted]-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 25300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView on unpkg

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View file

•path = [redacted]-[redacted]-latin-600-normal.woff2 kind = high_entropy_blob sizeBytes = 24452 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View on unpkg

Source & flagged code

7 flagged · loading source

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView file

17const fs = require("fs"); L18: const cp = require("child_process"); L19: const dnaLib = require("./lib-dna.cjs");

High

Child Process

Package source references child process execution.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView on unpkg · L17

packages/cli/vendor/hyperframes/registry/examples/vscode-theme-visualizer/scripts/build-compositions.mjsView file

19.replace(/;\s*$/, ""); L20: const registry = new Function("return (" + registryBody + ")")(); L21: const clipDuration = 11;

Low

Eval

Package source references a known benign dynamic code generation pattern.

packages/cli/vendor/hyperframes/registry/examples/vscode-theme-visualizer/scripts/build-compositions.mjs

Findings

5 High5 Medium6 Low

HighChild Processpackages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjs

HighShell

HighSame File Env Network Executionpackages/cli/src/project.ts

HighCredential Exfiltrationpackages/cli/src/music/providers/minimax.ts

HighShips High Entropy Blobpackages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2

MediumDynamic Requirepackages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/build-fonts-css.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpackages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.sh

MediumStructural Risk Force Deep Review

Low

Source & flagged code

7 flagged

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/*

3 * make-composition.cjs — compile plan.json → index.html (CINEMATIC MODE).

4 *

5 * DNA path (canonical): plan.dna names a dna/<name>.json → modes/cinematic/engine.html

6 * is compiled with scene-resolved tokens (lib-dna.cjs): scene-sampled accent, light-

7 * direction contact shadow, depth-match blur, hero three-act orchestration with

8 * RMS-coupled amplitude. plan.template="cinematic-cream" maps to dna "cream".

9 *

10 * Legacy path: plan.template naming an archived template dir still compiles 1:1

11 * (memory-wall / champion / portrait-header in modes/cinematic/_archive are NOT

12 * auto-discovered — restore them to modes/cinematic/ to use).

13 *

14 * node make-composition.cjs <project-dir>

15 */

16const path = require("path");

17const fs = require("fs");

18const cp = require("child_process");

19const dnaLib = require("./lib-dna.cjs");

High

Child Process

Package source references child process execution.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/make-composition.cjsView on unpkg · L17

21const SKILL_ROOT = path.resolve(__dirname, "..");

22const TEMPLATES = path.join(SKILL_ROOT, "modes", "cinematic");

24// Source clip duration (seconds) via ffprobe. The COMPOSITION/background length must

25// follow the SOURCE, not the last caption — see the Bug-1 note in main().

26function sourceDurationSec(project) {

27 let cands = ["source.mp4"];

28 try {

29 cands = cands.concat(

30 fs

31 .readdirSync(project)

32 .filter(

33 (f) =>

34 /\.(mp4|mov|webm|mkv|m4v)$/i.test(f) &&

35 !/^(final|bg_plus_caps|fg_caps|rail|index)/.test(f),

36 ),

37 );

packages/cli/vendor/hyperframes/registry/examples/vscode-theme-visualizer/scripts/build-compositions.mjsView file

Lines 1-39javascript

1import fs from "node:fs";

2import path from "node:path";

3import { fileURLToPath } from "node:url";

5const

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/build-fonts-css.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/*

3 * build-fonts-css.cjs — bundle the template fonts into ONE self-contained

4 * fonts.css with base64 data-URI @font-face (no sub-resources, no CDN, no

5 * system-font dependency). This is what makes Standard/Cinematic renders

6 * deterministic on ANY machine: hyperframes' renderer only auto-supplies its

7 * ~18 CANONICAL_FONTS; every other family falls back to a generic font unless

8 * the HTML ships a local @font-face. (hyperframes' own font linter says exactly

9 * this: "Use local @font-face declarations with captured .woff2 files.")

packages/cli/src/project.tsView file

Lines 5801-5841typescript

5801 return parseEditPlan(readProjectJson(projectPath, projectArtifacts.editPlan, "edit plan"), manifest);

5802 } catch (error) {

5803 if (error instanceof Error && error.message.includes("asset_usage_plan"

packages/cli/src/music/providers/minimax.tsView file

Lines 4-44typescript

5export type MusicProviderResult = {

6 provider: string;

7 model?: string;

8 prompt?:

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView file

•path = [redacted]-captions/scripts/render-and-composite.sh kind = build_helper sizeBytes = 25300 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

packages/cli/vendor/hyperframes/resources/embedded-captions/scripts/render-and-composite.shView on unpkg

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View file

•path = [redacted]-[redacted]-latin-600-normal.woff2 kind = high_entropy_blob sizeBytes = 24452 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

packages/cli/vendor/hyperframes/resources/embedded-captions/modes/standard/fonts/files/inter-latin-600-normal.woff2View on unpkg