registry / nekostream / 2026.3.1

nekostream@2026.3.1

⚠ Under review

Bettter version of NekoStream

Static Scan Results

scanned 43m ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 38 file(s), 414 KB of source, external domains: anime47.best, animehay.ink, animehay01.site, animevietsub.bz, animevietsub.fan, animevietsub.love, animevietsub.site, animevietsub.tv, api.jikan.moe, discord.gg, graphql.anilist.co, media.anilist.co, registry.npmjs.org, s4.anilist.co, www.npmjs.com

Source & flagged code

5 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@ghostery/adblocker-playwright": "^2.18.1",

38 "@inquirer/prompts": "^8.5.2",

39 "artplayer": "^5.3.0",

40 "chalk": "^4.1.2",

41 "cheerio": "^1.2.0",

42 "cross-fetch": "^4.1.0",

43 "discord-rpc": "^4.0.1",

44 "electron": "^43.0.0",

45 "fastify": "^5.9.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

dist/player.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nekostream@2026.1.4 matchedIdentity = npm:bmVrb3N0cmVhbQ:2026.1.4 similarity = 0.560 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/player.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = playwright install chromium

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = playwright install chromium

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

40const path_1 = __importDefault(require("path")); L41: const child_process_1 = require("child_process"); L42: const prompts_wrapper_1 = __importDefault(require("./prompts-wrapper"));

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L40

598if (update) { L599: const installCommand = `npm i -g ${NPM_PACKAGE_NAME}@latest`; L600: const spinner = (0, ora_1.default)(`Đang cập nhật (${installCommand})...`).start(); L601: try { L602: (0, child_process_1.execSync)(installCommand, { stdio: 'ignore' }); L603: spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L598

dist/player.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/player.jsView on unpkg

Findings

1 Critical3 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/player.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighRuntime Package Installdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@ghostery/adblocker-playwright": "^2.18.1",

38 "@inquirer/prompts": "^8.5.2",

39 "artplayer": "^5.3.0",

40 "chalk": "^4.1.2",

41 "cheerio": "^1.2.0",

42 "cross-fetch": "^4.1.0",

43 "discord-rpc": "^4.0.1",

44 "electron": "^43.0.0",

45 "fastify": "^5.9.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

dist/player.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/player.jsView on unpkg

Lines 578-618javascript

578 }

579}

580async function checkUpdate() {

581 try {

582 const isCompiled = __dirname.endsWith('dist') || __dirname.endsWith('dist\\') || __dirname.endsWith('dist/');

583 const basePath = isCompiled ? path_1.default.join(__dirname, '..') : __dirname;

584 const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(basePath, 'package.json'), 'utf-8'));

585 const currentVersion = pkg.version;

586 const res = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`, { signal: AbortSignal.timeout(2000) });

587 const data = await res.json();

588 const latestVersion = data.version;

589 if (latestVersion && latestVersion !== currentVersion) {

590 (0, ui_1.clearScreen)();

591 (0, ui_1.printUpdateNotice)(currentVersion, latestVersion, NPM_PACKAGE_NAME);

592 const { update } = await (0, prompts_wrapper_1.default)({

593 type: 'confirm',

594 name: 'update',

595 message: 'Bạn có muốn tự động cập nhật ngay bây giờ?',

596 initial: true

597 });

598 if (update) {

599 const installCommand = `npm i -g ${NPM_PACKAGE_NAME}@latest`;

600 const spinner = (0, ora_1.default)(`Đang cập nhật (${installCommand})...`).start();

601 try {

602 (0, child_process_1.execSync)(installCommand, { stdio: 'ignore' });

603 spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L598

604 }

605 catch (e) {

606 spinner.fail(chalk_1.default.red(`Cập nhật thất bại. Vui lòng chạy thủ công: ${installCommand}`));

607 }

608 process.exit(0);

609 }

610 else {

611 console.log(chalk_1.default.red(`\nVui lòng chạy \`npm i -g ${NPM_PACKAGE_NAME}@latest\` để cập nhật thủ công.`));

612 process.exit(0);

613 }

614 }

615 }

616 catch (e) {

617 // Ignore network/fetch errors to not block startup

618 }