registry / peertube-plugin-yaktube-ondemand / 1.5.2

peertube-plugin-yaktube-ondemand@1.5.2

Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installing the plugin runs author-controlled browser code on every page. That code loads an unpinned remote script and, by default, forwards a stored PeerTube access token, email, and username to developer-console.yakhub.com.tr. The server side also authenticates to the local PeerTube API with a published admin password.

Static reason

One or more suspicious static signals were detected.

Trigger

PeerTube loads the common client script after the plugin is enabled. Search-history sync runs at startup when a token is present. The admin password is used when the import route runs.

Impact

Visitors execute remote JavaScript chosen by the package author. Logged-in session tokens and account identifiers are sent to an unrelated host. The published admin password can be reused against the targeted PeerTube API.

Mechanism

client.js appends a script tag for the latest file on cdnjs.yakhub.com.tr, opens a hidden SSO iframe, and fetches the author search-history API with the local bearer token. main.js posts a hardcoded password grant to 127.0.0.1 port 9000.

Attack narrative

After a PeerTube admin enables the plugin, every visitor loads client.js. That script pulls an unpinned account bundle from the author CDN and, when a local access token exists, sends the token, email, and username to developer-console.yakhub.com.tr unless the user previously set sync off. A hidden SSO frame and an origin-unchecked message handler can also drive login or session clearing. Separately, the import handler logs into the local API as a fixed admin account using a password shipped in the package.

AI rationale

The common client entry loads unpinned remote code and, by default, forwards the stored PeerTube bearer token, email, and username to a package-controlled host. A fixed admin password in main.js is an additional concrete credential backdoor against the local PeerTube API.

Evidence

package.jsonclient.js

peertube-plugin-yaktube-ondemand@1.5.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code