registry / neo2-flightpath / 0.1.1
neo2-flightpath@0.1.1
Render flight-path map overlay videos (exactly the source frame rate and frame count) from DJI drone recordings - telemetry from the .SRT sidecar or the embedded CAM-meta (DVTM) stream.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe launcher runs an ordinary CLI for processing user-supplied recordings; process execution is limited to ffmpeg/ffprobe, while network access retrieves map tiles for rendering. The `prepare` script runs the package build, and the inspected source shows no malicious collection or unrelated automatic action.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked by the user; tile fetching and video processing occur for requested recordings.
Impact
Creates rendered video output and a local tile cache; no malicious impact was identified.
Mechanism
Reads video telemetry, fetches missing map tiles from the configured map providers, caches them, and uses ffmpeg/ffprobe to render and verify output.
AI rationale
The launcher runs an ordinary CLI for processing user-supplied recordings; process execution is limited to ffmpeg/ffprobe, while network access retrieves map tiles for rendering. The `prepare` script runs the package build, and the inspected source shows no malicious collection or unrelated automatic action.
Evidence
configured rendered video output pathconfigured tile cache path (default: ~/.cache/neo2-flightpath/tiles)
Network endpoints2
server.arcgisonline.com/ArcGIS/rest/services/World_Imagery/MapServer/tile/{z}/{y}/{x}{s}.tile.opentopomap.org/{z}/{x}/{y}.png
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is `prepare`, which runs the TypeScript build.
- The executable calls the CLI when the user runs the command.
- `ffmpeg` and `ffprobe` are invoked for video probing and encoding.
- Missing map tiles are fetched from the configured map providers and cached for rendering.
- Tile fetching is called as part of processing a requested recording.
Evidence against
- The reviewed runtime code contains no behavior that sends credentials, environment data, or project files to a collector.
- Network requests retrieve map tiles from the providers named for the rendering feature.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/ff.jsView file
2// ffmpeg and ffprobe are expected on PATH (never bundled).
L3: import { execFile } from 'node:child_process';
L4: import { promisify } from 'node:util';
High
dist/render.jsView file
101throw new Error(`could not launch a Chromium browser (tried explicit path, channel=chrome, channel=msedge, playwright registry): ${msg}. ` +
L102: 'Install Google Chrome or Microsoft Edge, run "npx playwright install chromium", ' +
L103: 'or pass --browser <path>.');
...
L105: function spawnEncoder(fpsStr, preset, outPath) {
L106: const ffmpeg = spawn('ffmpeg', [
L107: '-hide_banner', '-loglevel', 'error', '-y',
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/render.jsView on unpkg · L101dist/render.js#virtual:normalized:round1View file
Findings
3 High3 Medium6 Low
HighChild Processdist/ff.js
HighRuntime Package Installdist/render.js
HighSemantic Analysis Limiteddist/render.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to neo2-flightpath@0.1.1.
See all versions of neo2-flightpath for other recorded verdicts.
- Review the evidence and your use of neo2-flightpath@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.