registry / motionrender / 0.2.0
motionrender@0.2.0
⚠ Under reviewJSON-first, frame-deterministic motion graphics video engine: render compositions to MP4, WebM, ProRes, GIF or PNG frames from Node or the command line.
Static Scan Results
scanned 1d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
837// packages/core/src/media.ts
L838: import { spawn as spawn2 } from "node:child_process";
L839: import { mkdir, readFile as readFile2, stat as stat2, writeFile } from "node:fs/promises";
High
studio/assets/index-J_fvKgng.jsView file
9`).replace(j0,"")}function Tm(l,t){return t=bm(t),bm(l)===t}function bl(l,t,e,a,u,n){switch(e){case"children":if(typeof a=="string")t==="body"||t==="textarea"&&a===""||Da(l,a);else...
L10: `)}):null]})})}const Fy=D.forwardRef(function({detail:E,startFrame:p},r){const N=D.useRef(null),C=D.useRef(null),[U,w]=D.useState(p),[Z,K]=D.useState(!1),[_,d]=D.useState(""),j=E.d...
L11: `,"Put your key in a .env file as GROQ_API_KEY=... and start the studio again."]}):f.jsx(pt,{children:"Connected. Creating videos, voiceovers and AI changes use this provider; edit...
Low
Eval
Package source references a known benign dynamic code generation pattern.
studio/assets/index-J_fvKgng.jsView on unpkg · L9Findings
5 High4 Medium5 Low
HighChild Processdist/index.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/runtime/canvas-runtime.js#virtual:normalized:round1
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalstudio/assets/index-J_fvKgng.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to motionrender@0.2.0.
See all versions of motionrender for other recorded verdicts.
- Review the evidence and your use of motionrender@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.