registry / nekostream / 2026.2.7

nekostream@2026.2.7

⚠ Under review

Bettter version of NekoStream

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 385 KB of source, external domains: anime47.best, animehay.ink, animehay01.site, animevietsub.bz, animevietsub.fan, animevietsub.love, animevietsub.site, animevietsub.tv, api.jikan.moe, discord.gg, graphql.anilist.co, media.anilist.co, registry.npmjs.org, s4.anilist.co, www.npmjs.com

Source & flagged code

5 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "./bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@cliqz/adblocker-playwright": "^1.34.0",

38 "@ghostery/adblocker-playwright": "^2.17.1",

39 "@inquirer/prompts": "^8.4.2",

40 "artplayer": "^5.3.0",

41 "chalk": "^4.1.2",

42 "cheerio": "^1.2.0",

43 "cross-fetch": "^4.1.0",

44 "discord-rpc": "^4.0.1",

45 "electron": "^34.0.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

dist/player.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nekostream@2026.1.4 matchedIdentity = npm:bmVrb3N0cmVhbQ:2026.1.4 similarity = 0.680 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/player.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = playwright install chromium

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = playwright install chromium

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

40const path_1 = __importDefault(require("path")); L41: const child_process_1 = require("child_process"); L42: const prompts_wrapper_1 = __importDefault(require("./prompts-wrapper"));

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L40

591if (update) { L592: const installCommand = `npm i -g ${NPM_PACKAGE_NAME}@latest`; L593: const spinner = (0, ora_1.default)(`Đang cập nhật (${installCommand})...`).start(); L594: try { L595: (0, child_process_1.execSync)(installCommand, { stdio: 'ignore' }); L596: spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L591

dist/player.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/player.jsView on unpkg

Findings

1 Critical3 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/player.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighRuntime Package Installdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 6-46json

6 "anime",

7 "scraper",

8 "animevietsub",

9 "animetvn",

10 "anime47",

11 "nekostream",

12 "cli",

13 "video-player",

14 "streaming",

15 "vietsub",

16 "anime-cli"

17 ],

18 "main": "dist/index.js",

19 "bin": {

20 "nekostream": "./bin/nekostream.js"

21 },

22 "scripts": {

23 "start": "tsx index.ts",

24 "build": "tsc",

25 "prepublishOnly": "npm run build",

26 "postinstall": "playwright install chromium"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "dist",

30 "bin",

31 "player-main.js",

32 "player.html",

33 "isolate.js",

34 "isolate.css"

35 ],

36 "dependencies": {

37 "@cliqz/adblocker-playwright": "^1.34.0",

38 "@ghostery/adblocker-playwright": "^2.17.1",

39 "@inquirer/prompts": "^8.4.2",

40 "artplayer": "^5.3.0",

41 "chalk": "^4.1.2",

42 "cheerio": "^1.2.0",

43 "cross-fetch": "^4.1.0",

44 "discord-rpc": "^4.0.1",

45 "electron": "^34.0.0",

46 "hls.js": "^1.6.0",

dist/index.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

dist/player.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/player.jsView on unpkg

Lines 571-611javascript

571 const basePath = isCompiled ? path_1.default.join(__dirname, '..') : __dirname;

572 const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(basePath, 'package.json'), 'utf-8'));

573 const currentVersion = pkg.version;

574 const res = await fetch(`https://registry.npmjs.org/${NPM_PACKAGE_NAME}/latest`, { signal: AbortSignal.timeout(2000) });

575 const data = await res.json();

576 const latestVersion = data.version;

577 if (latestVersion && latestVersion !== currentVersion) {

578 (0, ui_1.clearScreen)();

579 console.log(chalk_1.default.yellow('╭─────────────────────────────────────────────────────────────╮'));

580 console.log(chalk_1.default.yellow('│ │'));

581 console.log(chalk_1.default.yellow(`│ NEKOSTREAM ĐÃ CÓ CẬP NHẬT MỚI ! ${chalk_1.default.red(currentVersion)} → ${chalk_1.default.green(latestVersion)} │`));

582 console.log(chalk_1.default.yellow('│ Vui lòng cập nhật ứng dụng CLI để tiếp tục sử dụng ứng dụng. │'));

583 console.log(chalk_1.default.yellow('│ │'));

584 console.log(chalk_1.default.yellow('╰─────────────────────────────────────────────────────────────╯\n'));

585 const { update } = await (0, prompts_wrapper_1.default)({

586 type: 'confirm',

587 name: 'update',

588 message: 'Bạn có muốn tự động cập nhật ngay bây giờ?',

589 initial: true

590 });

591 if (update) {

592 const installCommand = `npm i -g ${NPM_PACKAGE_NAME}@latest`;

593 const spinner = (0, ora_1.default)(`Đang cập nhật (${installCommand})...`).start();

594 try {

595 (0, child_process_1.execSync)(installCommand, { stdio: 'ignore' });

596 spinner.succeed(chalk_1.default.green('Đã cập nhật thành công! Vui lòng chạy lại lệnh để sử dụng bản mới.'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L591

597 }

598 catch (e) {

599 spinner.fail(chalk_1.default.red(`Cập nhật thất bại. Vui lòng chạy thủ công: ${installCommand}`));

600 }

601 process.exit(0);

602 }

603 else {

604 console.log(chalk_1.default.red(`\nVui lòng chạy \`npm i -g ${NPM_PACKAGE_NAME}@latest\` để cập nhật thủ công.`));

605 process.exit(0);

606 }

607 }

608 }

609 catch (e) {

610 // Ignore network/fetch errors to not block startup

611 }