registry / nekostream / 2026.2.1

nekostream@2026.2.1

⚠ Under review

Bettter version of NekoStream

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 378 KB of source, external domains: anime47.best, animehay.ink, animehay01.site, animevietsub.bz, animevietsub.fan, animevietsub.love, animevietsub.site, animevietsub.tv, api.jikan.moe, discord.gg, graphql.anilist.co, media.anilist.co, registry.npmjs.org, s4.anilist.co, www.npmjs.com

Source & flagged code

5 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "./bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@cliqz/adblocker-playwright": "^1.34.0",

38 "@ghostery/adblocker-playwright": "^2.17.1",

39 "@inquirer/prompts": "^8.4.2",

40 "artplayer": "^5.3.0",

41 "chalk": "^4.1.2",

42 "cheerio": "^1.2.0",

43 "cross-fetch": "^4.1.0",

44 "discord-rpc": "^4.0.1",

45 "electron": "^34.0.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = playwright install chromium

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = playwright install chromium

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nekostream@2026.1.4 matchedIdentity = npm:bmVrb3N0cmVhbQ:2026.1.4 similarity = 0.760 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

40const path_1 = __importDefault(require("path")); L41: const child_process_1 = require("child_process"); L42: const prompts_wrapper_1 = __importDefault(require("./prompts-wrapper"));

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L40

582if (update) { L583: const installCommand = `npm i -g ${NPM_PACKAGE_NAME}@latest`; L584: const spinner = (0, ora_1.default)(`Đang cập nhật (${installCommand})...`).start(); L585: try { L586: (0, child_process_1.execSync)(installCommand, { stdio: 'ignore' }); L587: spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L582

Findings

1 Critical3 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighRuntime Package Installdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "./bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@cliqz/adblocker-playwright": "^1.34.0",

38 "@ghostery/adblocker-playwright": "^2.17.1",

39 "@inquirer/prompts": "^8.4.2",

40 "artplayer": "^5.3.0",

41 "chalk": "^4.1.2",

42 "cheerio": "^1.2.0",

43 "cross-fetch": "^4.1.0",

44 "discord-rpc": "^4.0.1",

45 "electron": "^34.0.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

Lines 562-602javascript

562 const basePath = isCompiled ? path_1.default.join(__dirname, '..') : __dirname;

563 const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(basePath, 'package.json'), 'utf-8'));

564 const currentVersion = pkg.version;

565 const res = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`, { signal: AbortSignal.timeout(2000) });

566 const data = await res.json();

567 const latestVersion = data.version;

568 if (latestVersion && latestVersion !== currentVersion) {

569 (0, ui_1.clearScreen)();

570 console.log(chalk_1.default.yellow('╭─────────────────────────────────────────────────────────────╮'));

571 console.log(chalk_1.default.yellow('│ │'));

572 console.log(chalk_1.default.yellow(`│ NEKOSTREAM ĐÃ CÓ CẬP NHẬT MỚI ! ${chalk_1.default.red(currentVersion)} → ${chalk_1.default.green(latestVersion)} │`));

573 console.log(chalk_1.default.yellow('│ Vui lòng cập nhật ứng dụng CLI để tiếp tục sử dụng ứng dụng. │'));

574 console.log(chalk_1.default.yellow('│ │'));

575 console.log(chalk_1.default.yellow('╰─────────────────────────────────────────────────────────────╯\n'));

576 const { update } = await (0, prompts_wrapper_1.default)({

577 type: 'confirm',

578 name: 'update',

579 message: 'Bạn có muốn tự động cập nhật ngay bây giờ?',

580 initial: true

581 });

582 if (update) {

583 const installCommand = `npm i -g ${NPM_PACKAGE_NAME}@latest`;

584 const spinner = (0, ora_1.default)(`Đang cập nhật (${installCommand})...`).start();

585 try {

586 (0, child_process_1.execSync)(installCommand, { stdio: 'ignore' });

587 spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L582

588 }

589 catch (e) {

590 spinner.fail(chalk_1.default.red(`Cập nhật thất bại. Vui lòng chạy thủ công: ${installCommand}`));

591 }

592 process.exit(0);

593 }

594 else {

595 console.log(chalk_1.default.red(`\nVui lòng chạy \`npm i -g ${NPM_PACKAGE_NAME}@latest\` để cập nhật thủ công.`));

596 process.exit(0);

597 }

598 }

599 }

600 catch (e) {

601 // Ignore network/fetch errors to not block startup

602 }