registry / lazydlp / 0.0.5

lazydlp@0.0.5

A sleek, interactive Terminal User Interface (TUI) for `yt-dlp`.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The runtime downloads or invokes yt-dlp for its advertised video-download function after CLI execution; no package-side data exfiltration or persistence beyond its own config was found.

Static reason

No blocking static signals were detected.

Trigger

User runs the lazydlp CLI; /configure, /download, /update, or settings actions invoke related behavior.

Impact

Package-aligned video downloading and local ~/.lazydlp configuration; no confirmed malicious impact.

Mechanism

Interactive wrapper that installs/invokes yt-dlp and stores local configuration.

Rationale

Source implements the documented yt-dlp TUI behavior after user CLI execution. No concrete malicious chain, install-time mutation, credential exfiltration, or foreign control-surface modification was found.

Evidence

package.jsondist/app.jsdist/hooks/use-app-state.jsdist/hooks/use-yt-dlp.jsdist/utils/yt-dlp-utils.jsdist/utils/config.jsdist/components/settings-menu.js~/.lazydlp/yt-dlp~/.lazydlp/config.json

Network endpoints1

github.com/yt-dlp/yt-dlp/releases/latest/download/${filename}

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

No install, preinstall, or postinstall lifecycle hook in package.json.
No credential harvesting, exfiltration endpoint, eval, or agent-control writes found.

Evidence against

dist/app.js is a user-invoked CLI entrypoint.
dist/hooks/use-app-state.js auto-configures yt-dlp only when the CLI runs.
dist/hooks/use-yt-dlp.js downloads yt-dlp from GitHub or invokes pip for the stated downloader function.
Browser-cookie use is an explicit settings option passed to yt-dlp.
Config/history writes are limited to ~/.lazydlp/config.json.

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 77.2 KB of source, external domains: github.com

Source & flagged code

1 flagged

package.jsonView file

Lines 1-32json

2 "name": "lazydlp",

3 "version": "0.0.5",

4 "license": "MIT",

5 "bin": {

6 "lazydlp": "dist/app.js"

7 },

8 "type": "module",

9 "engines": {

10 "node": ">=16"

11 },

12 "scripts": {

Low

Suspicious Lifecycle Evidence

No install, preinstall, or postinstall lifecycle hook in package.json.

package.jsonView on unpkg · L12

13 "build": "tsc",

14 "dev": "tsc --watch",

15 "test": "prettier --check . && xo && ava"

16 },

17 "files": [

18 "dist",

19 "assets",

20 "README.md"

21 ],

22 "dependencies": {

23 "@types/ink-text-input": "^2.0.5",

24 "ink": "^4.1.0",

25 "ink-gradient": "^4.0.1",

26 "ink-spinner": "^5.0.0",

27 "ink-text-input": "^5.0.1",

28 "open": "^11.0.0",

29 "react": "^18.2.0",

30 "zod": "^4.4.3",

31 "zustand": "^5.0.14"

32 },

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

Low

Suspicious Lifecycle Evidence

No install, preinstall, or postinstall lifecycle hook in package.json.

package.jsonView on unpkg

Findings

1 Medium6 Low

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidence