registry / nekostream / 2026.1.4

nekostream@2026.1.4

Bettter version of NekoStream

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 368 KB of source, external domains: anime47.best, animehay.ink, animehay01.site, animevietsub.site, api.jikan.moe, cdnjs.cloudflare.com, discord.gg, graphql.anilist.co, media.anilist.co, registry.npmjs.org, s4.anilist.co, www.npmjs.com

Source & flagged code

4 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "./bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@cliqz/adblocker-playwright": "^1.34.0",

38 "@ghostery/adblocker-playwright": "^2.17.1",

39 "@inquirer/prompts": "^8.4.2",

40 "artplayer": "^5.3.0",

41 "chalk": "^4.1.2",

42 "cheerio": "^1.2.0",

43 "cross-fetch": "^4.1.0",

44 "discord-rpc": "^4.0.1",

45 "electron": "^34.0.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = playwright install chromium

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = playwright install chromium

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

40const path_1 = __importDefault(require("path")); L41: const child_process_1 = require("child_process"); L42: const prompts_wrapper_1 = __importDefault(require("./prompts-wrapper"));

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L40

583try { L584: (0, child_process_1.execSync)('npm i -g nekostream-cli@latest', { stdio: 'ignore' }); L585: spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L583

Findings

3 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighRuntime Package Installdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "./bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@cliqz/adblocker-playwright": "^1.34.0",

38 "@ghostery/adblocker-playwright": "^2.17.1",

39 "@inquirer/prompts": "^8.4.2",

40 "artplayer": "^5.3.0",

41 "chalk": "^4.1.2",

42 "cheerio": "^1.2.0",

43 "cross-fetch": "^4.1.0",

44 "discord-rpc": "^4.0.1",

45 "electron": "^34.0.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

Lines 563-603javascript

563 const currentVersion = pkg.version;

564 const res = await fetch('https://registry.npmjs.org/nekostream-cli/latest', { signal: AbortSignal.timeout(2000) });

565 const data = await res.json();

566 const latestVersion = data.version;

567 if (latestVersion && latestVersion !== currentVersion) {

568 (0, ui_1.clearScreen)();

569 console.log(chalk_1.default.yellow('╭─────────────────────────────────────────────────────────────╮'));

570 console.log(chalk_1.default.yellow('│ │'));

571 console.log(chalk_1.default.yellow(`│ NEKOSTREAM ĐÃ CÓ CẬP NHẬT MỚI ! ${chalk_1.default.red(currentVersion)} → ${chalk_1.default.green(latestVersion)} │`));

572 console.log(chalk_1.default.yellow('│ Vui lòng cập nhật ứng dụng CLI để tiếp tục sử dụng ứng dụng. │'));

573 console.log(chalk_1.default.yellow('│ │'));

574 console.log(chalk_1.default.yellow('╰─────────────────────────────────────────────────────────────╯\n'));

575 const { update } = await (0, prompts_wrapper_1.default)({

576 type: 'confirm',

577 name: 'update',

578 message: 'Bạn có muốn tự động cập nhật ngay bây giờ?',

579 initial: true

580 });

581 if (update) {

582 const spinner = (0, ora_1.default)('Đang cập nhật (npm i -g nekostream-cli@latest)...').start();

583 try {

584 (0, child_process_1.execSync)('npm i -g nekostream-cli@latest', { stdio: 'ignore' });

585 spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L583

586 }

587 catch (e) {

588 spinner.fail(chalk_1.default.red('Cập nhật thất bại. Vui lòng chạy thủ công: npm i -g nekostream-cli@latest'));

589 }

590 process.exit(0);

591 }

592 else {

593 console.log(chalk_1.default.red('\nVui lòng chạy `npm i -g nekostream-cli@latest` để cập nhật thủ công.'));

594 process.exit(0);

595 }

596 }

597 }

598 catch (e) {

599 // Ignore network/fetch errors to not block startup

600 }

601}

602async function main() {

603 await checkUpdate();