registry / peertube-plugin-yaktube-ondemand / 1.4.31

peertube-plugin-yaktube-ondemand@1.4.31

⚠ Under review

Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations and A11y Engine for PeerTube

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 2 file(s), 169 KB of source, external domains: auth.yakhub.com.tr, i.ytimg.com, www.youtube.com, yaktube.yakhub.com.tr

Source & flagged code

1 flagged

main.jsView file

Lines 32-72javascript

32 return new Promise((resolve, reject) => {

33 const req = http.request(

34 {

35 hostname: '127.0.0.1',

36 port: 9000,

37 path: '/api/v1/oauth-clients/local',

38 method: 'GET',

39 headers: { Host: 'yaktube.yakhub.com.tr' }

40 },

41 res => {

42 let body = '';

43 res.on('data', chunk => (body += chunk));

44 res.on('end', () => {

45 try {

46 const oauth = JSON.parse(body);

47 const postData = new URLSearchParams({

48 client_id: oauth.client_id,

49 client_secret: oauth.client_secret,

50 grant_type: 'password',

51 username: 'yaktube',

52 password: 'YakTubeAdmin2026!'

Medium

Secret Pattern

Package contains a possible secret pattern.

main.jsView on unpkg · L52

53 }).toString();

55 const tokenReq = http.request(

56 {

57 hostname: '127.0.0.1',

58 port: 9000,

59 path: '/api/v1/users/token',

60 method: 'POST',

61 headers: {

62 Host: 'yaktube.yakhub.com.tr',

63 'Content-Type': 'application/x-www-form-urlencoded',

64 'Content-Length': Buffer.byteLength(postData)

65 }

66 },

67 tokenRes => {

68 let tokenBody = '';

69 tokenRes.on('data', c => (tokenBody += c));

70 tokenRes.on('end', () => {

71 try {

72 const tData = JSON.parse(tokenBody);

Source & flagged code

1 flagged · loading source

main.jsView file

52patternName = generic_password severity = medium line = 52

Medium

peertube-plugin-yaktube-ondemand@1.4.31

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code