Loading npm security reports…
Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube
The runtime exposes an import endpoint that authenticates to the local PeerTube API with package-embedded administrator credentials. No external exfiltration endpoint was found in the active server flow.
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
main.jsView on unpkg · L1The active server module obtains local OAuth client data and builds a password-grant request using embedded administrator credentials.
main.jsView on unpkg · L130An unauthenticated plugin import route invokes that administrator-token routine before submitting a PeerTube import.
main.jsView on unpkg · L244The manifest loads main.js as the package entrypoint.
package.jsonView on unpkg · L5This report applies to peertube-plugin-yaktube-ondemand@1.5.0.
See version security history for other recorded verdicts.
Evidence last updated: .
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
main.jsView on unpkg · L1The active server module obtains local OAuth client data and builds a password-grant request using embedded administrator credentials.
main.jsView on unpkg · L130An unauthenticated plugin import route invokes that administrator-token routine before submitting a PeerTube import.
main.jsView on unpkg · L244The manifest loads main.js as the package entrypoint.
package.jsonView on unpkg · L5